On March 31, 2014, Governor Cuomo signed Chapter 56 of the Laws of 2014, a budget bill which amends a number of New York State Laws. Through this budget bill two new sections were added to the New York State Education Law (“Education Law”), Sections 2-c and 2-d, which relate to the release of student data.
Education Law Section 2-c
Education Law Section 2-c allows an educational agency to opt out of providing personally identifiable information of a student to a “shared learning infrastructure service provider” (“SLISP”) or data dashboard operator for the purpose of creating data dashboards. Hence, an educational agency has the right to request that any personally identifiable information of its students not be shared with or provided to a SLISP or data dashboard operator at any time. This request must be made directly to the New York State Education Department (“NYSED”). After the request is made, NYSED must take all actions necessary to prevent and prohibit the sharing or providing of such information to any SLISP or data dashboard operator and must ensure that any personally identifiable information already provided to them is deleted and destroyed in a secure manner.
Section 2-c also prohibits the Commissioner of Education (the “Commissioner”) and NYSED from providing any student information to a SLISP and requires them to immediately ensure that any student information previously provided to any SLISP is deleted and destroyed in a secure manner.
Section 2-c defines “student information” to be personally identifiable information and biometric records as defined by the Family Educational Rights and Privacy Act (“FERPA”) and its implementing regulations or any other individual student record or any “de-identifiable information,” which means a collection of data or information that has been altered with the goal of making the student or students associated with such data or information permanently unknowable. “Educational agencies” include inter alia public school districts and BOCES.
It adopts the definition of “personally identifiable information” that is contained in federal regulations implementing FERPA. Thus, “personally identifiable information” includes, but is not limited to:
(a) the student’s name;
(b) the name of the student’s parent or other family members;
(c) the address of the student or student’s family;
(d) a personal identifier, such as the student’s social security number, student number, or biometric record;
(e) other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
(f) other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
(g) information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
Section 2-c defines a SLISP as any entity, other than a BOCES, a BOCES Regional Information Center (“RIC”) or other public entity, that collects, stores, organizes, or aggregates student information and contracts with or enters into an agreement with NYSED for the purposes of providing student information to a data dashboard operator for use in a data dashboard.
Education Law Section 2-d
Education Law Section 2-d governs the unauthorized release of student information to certain entities, and sets out a number of requirements for the Commissioner, NYSED and public school districts.
Section 2-d(2) directs the Commissioner to appoint a Chief Privacy Officer whose functions include, but are not limited to, promoting the implementation of sound practices for the privacy and security of student, teacher and principal data, assisting the Commissioner and educational agencies in their obligations pertaining to the privacy and security of student, teacher and principal data, formulating procedures and establishing protocols for possible breaches of student, teacher or principal data, making recommendations to NYSED, the New York State Legislature and the Governor, as well as issuing an annual report on data privacy and security activities.
Section 2-d(3) sets out the requirements for a “Parents’ Bill of Rights for Data Privacy and Security” (“Parents’ Bill of Rights”). The Parents’ Bill of Rights must be published on each educational agency’s website, as well as included with every contract an educational agency enters into with a third party contractor, when that third party contractor receives student, teacher or principal data. The Parents’ Bill of Rights must be completed within one hundred twenty (120) days after the effective date of this section (approximately August 1, 2014).
In accordance with Section 2-d(3)(b), the Parents’ Bill of Rights must state “in clear and plain English terms” that:
(1) A student’s personally identifiable information cannot be sold or released for any commercial purposes;
(2) Parents have the right to inspect and review the complete contents of their child’s education record;
(3) State and federal laws protect the confidentiality of personally identifiable information, and safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls, and password protection, must be in place when data is stored or transferred;
(4) A complete list of all student data elements collected by the State is available for public review, and must include the website address and/or mailing address where the complete list of all student data elements collected by the State is available; and
(5) Parents have the right to have complaints about possible breaches of student data addressed, and the contact information, including phone number, email and mailing address of person to whom complaints should be directed.
For each contract an educational agency enters into with a third party contractor, where the third party contractor receives student, teacher or principal data, Section 2-d(3)(c) requires the Parents’ Bill of Rights to include the following supplemental information:
(1) the exclusive purposes for which the student data or teacher or principal data will be used;
(2) how the third party contractor will ensure that the subcontractors, persons or entities that the third party contractor will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements;
(3) when the agreement expires and what happens to the student data or teacher or principal data upon expiration of the agreement;
(4) if and how a parent, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected; and
(5) where the student data or teacher or principal data will be stored (described in such a manner as to protect data security), and the security protections taken to ensure such data will be protected, including whether such data will be encrypted.
For the purposes of Section 2-d, “student data” means “personally identifiable information” from student records of an educational agency. “Personally identifiable information” as applied to student data, means personally identifiable information as defined in the implementing regulations of FERPA. “Teacher or principal data” means personally identifiable information from the records of an educational agency relating to the annual professional performance reviews of classroom teachers or principals that is confidential and not subject to release under the provisions of Education Law Section 3012-c.
A third-party contractor is defined as any person or entity, other than an educational agency, that receives student data or teacher or principal data from an educational agency pursuant to a contract or other written agreement for purposes of providing services to such educational agency, including but not limited to data management or storage services, conducting studies for or on behalf of such educational agency, or audit or evaluation of publicly funded programs. For the purposes of Section 2-d, an educational partnership organization that receives student, teacher or principal data from a school district to carry out its responsibilities under Education Law Section 211-e and is not an educational agency, is considered a third-party contractor.
Section 2-d(3)(d) mandates that the Chief Privacy Officer, with input from parents and other education and expert stakeholders, develop additional elements of the Parents’ Bill of Rights, and that the Commissioner develop and promulgate regulations concerning the Parents’ Bill of Rights subject to a public comment period. As of this writing, NYSED has not yet promulgated such regulations.
Section 2-d(4) sets out certain requirements for data collection transparency and puts restrictions on NYSED’s data collection practices. This subsection also places responsibility on the Chief Privacy Officer to develop, regularly update and make publicly available an inventory and understandable description of the student, teacher and principal data elements collected with an explanation and/or legal or regulatory authority outlining the reasons such data elements are collected and the intended uses and disclosure of the data. As mentioned above, that this information is publicly available and where it is publicly available are required to be included in the Parents’ Bill of Rights. It is important to note that NYSED may only require school districts to submit personally identifiable information, including data on disability status and student suspensions, for an educational purpose and where such release is required by law or otherwise authorized under FERPA.
In addition, Section 2-d(4)(g) restates parents’ FERPA rights, adding in that parents also have a right to inspect and review any student data maintained by an educational agency. This subsection also directs NYSED to develop policies for school districts and other educational agencies that: (1) provide for annual notification to parents of their right to request student data; (2) ensure security when providing student data to parents, including that only authorized individuals receive such data; and (3) specify a reasonable amount of time in which school districts should respond to such requests. As of this writing, NYSED has not yet developed these notification policies.
Section 2-d(5) directs the Commissioner, in consultation with the Chief Privacy Officer, to develop regulations establishing standards for educational agency data security and privacy policies and to develop one or more model policies for use by school districts and other educational agencies. This section also sets out certain requirements for the Commissioner to include in the regulations and model policies. As of this writing, NYSED has neither developed the required regulations nor drafted these model policies.
Once these regulations are developed, each school district and educational agency must ensure that it has a policy on data security and privacy consistent with the regulations. This policy must be published on the educational agency’s website, and notice of such policy shall be provided to all officers and employees of the educational agency. This policy must provide all protections afforded to parents and persons in parental relationships, or students where applicable, required under FERPA and Individuals with Disabilities Education Act (“IDEA”), and their implementing regulations
Section 2-d sets out a number of requirements for any thirdparty contracts which involve the transmission and/or receipt of student, teacher or principal data. Section 2-d(5)(d) requires that school districts and other educational agencies which enter into written contracts or agreements with third-party contractors where the third-party contractor receives student, teacher or principal data, develop a data security and privacy plan that outlines how all state, federal, and local data security and privacy contract requirements will be implemented, consistent with the educational agency’s policy on data security and privacy (the “Plan”). Each third-party contract or agreement must include a copy of the Plan. This Plan must include, but is not be limited to, a signed copy of the Parents’ Bill of Rights, presumably with the supplemental information described above. The Plan must also include a requirement that any officers or employees of the third-party contractor and its assignees who have access to student, teacher or principal data have received or will receive training on the federal and the state laws governing confidentiality of such data prior to receiving access.
Section 2-d(5)(f) also sets out certain other requirements for third-party contracts and contractors. Each educational agency must ensure that it has in place provisions in its contracts with third party contractors or in separate data sharing and confidentiality agreements that require that confidentiality of the shared student, teacher and principal data be maintained in accordance with federal and state laws. Third-party contractors must agree to:
(1) limit internal access to education records to those individuals that are determined to have legitimate educational interests;
(2) not use the education records for any other purposes than those explicitly authorized in its contract;
(3) except for authorized representatives of the third party contractor to the extent they are carrying out the contract, not disclose any personally identifiable information to any other party:
(i) without the prior written consent of the parent/guardian or eligible student; or
(ii) unless required by statute or court order and the party provides a notice of the disclosure to the department, district board of education, or institution that provided the information no later than the time the information is disclosed, unless providing notice of the disclosure is expressly prohibited by the statute or court order;
(4) maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personally identifiable student information in its custody;
(5) use encryption technology to protect data while in motion or in its custody from unauthorized disclosure using a specified methodology.
Section 2-d(6) goes into explicit detail with regard to a breach and the unauthorized release of personally identifiable information by a third-party contractor. Third-party contractors have a duty to inform school districts and educational agencies in the event of a breach and/or unauthorized release of personally identifiable information. Once notified, school districts and other educational agencies must in turn notify the Chief Privacy Officer, as well as the subject of the personally identifiable information, whether it be student, teacher or principal data “in the most expedient way possible and without unreasonable delay.” The third-party contractor must promptly reimburse the educational agency for the full cost of such notification
Section 2-d(7) sets out provisions pertaining to implementation and enforcement. The Commissioner, in consultation with the Chief Privacy Officer, is directed to develop regulations establishing procedures to implement these provisions, including, but not limited to, procedures for the submission of complaints from parents, teacher and principals, or other educational agency staff, alleging that data has been improperly disclosed or released. As of this writing, the Commissioner has not yet developed these regulations. In addition, this section sets out civil monetary penalties for third-party contractors who violate the provisions of Section 2-d. Section 2-d(7) explicitly states that it has not established a private right of action against NYSED or any school district or educational agency. Finally, Section 2-d(7) states that it does not limit the administrative use of student, teacher or principal data by any person acting in their capacity as an employee of an educational agency, New York State, or any of its political subdivisions, any court, or the federal government.
To date, neither the Commissioner nor NYSED has developed and/or disseminated required regulations or policies. Our office will continually monitor the progress made by NYSED and the Commissioner on these requirements and will update you regarding same. In the meantime, however, Section 2-d does impose certain obligations on educational agencies, such as the development of a provisional Parents’ Bill of Rights, as well as the inclusion of the Bill of Rights and the additional language outlined above in any third-party contracts which involve the release of student, teacher or principal data.
Please feel free to contact Stephanie L. Burns, Esq. or Suzanne E. Volpe, Esq. of this office for assistance with the data privacy obligations of Sections 2-c and 2-d.
