Source: https://www.kblaw.com/2019/04/02/challenging-negative-declarations-under-the-new-york-state-environmental-quality-review-act-seqra-2/
Timestamp: 2019-04-24 07:06:59+00:00

Document:
The Time for Enforcement of Education Law § 2-d is Coming - Proposed Regulations Regarding Privacy and Security of Student Data and Teacher or Principal Data - Keane & Beane P.C.
The New York State Education Department has released proposed regulations implementing Education Law § 2-d. The full text of the proposed regulations, which will become Part 121 of the Commissioner’s Regulations, can be accessed on the Department’s website at the following link. It is expected that the Board of Regents will take final action on the proposed regulations in May, and that they will become effective as of July 1, 2019. The regulations may bring renewed attention to the statutory requirements, enacted in 2014, and applicable to educational agencies within New York, including school districts and boards of cooperative education. This legal alert reviews the requirements of the proposed regulations and includes reminders of the components of the statutory mandate.
Education Law § 2-d went into effect in April 2014. The focus of the statute was to foster privacy and security of personally identifiable information (PII) of students and certain PII related to classroom teachers and principals.
34 CFR §99.3. We also recommend protection of the additional element identified in the implementing regulations of the Individuals with Disabilities Education Act (IDEA), 20 U.S.C. § 1400 et seq., as PII, with regard to IDEA eligible students, that is: a list of personal characteristics or other information that would make it possible to identify the child with reasonable certainty. 34 CFR § 300.32.
The confidentiality and privacy provisions do not apply to de-identified data (e.g., data regarding students that uses random identifiers), aggregated data (e.g., data reported at the school district level) or anonymized data that could not be used to identify a particular student.
The protections in the statute also extend to teacher data or principal data, defined as PII from the records of an educational agency relating to the annual professional performance reviews of classroom teachers or principals that is confidential and not subject to release under the provisions of Education Law §§ 3012-c and 3012-d.
Although the proposed regulations largely restate the requirements of Education Law § 2-d, there are new elements, including the adoption by the New York State Education Department of a data security and privacy standard, as was required by the statute. The Department will adopt the National Institute for Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 (CSF or Framework). NIST is part of the United States Department of Commerce, and was originally established at the turn of the twentieth century to standardize measurement in the United States. In 2013, NIST was directed by Executive Order to develop a voluntary framework for reducing cyber risks to critical infrastructure based on existing standards, guidelines, and practices. As a result, the CSF was developed and will now be mandatory for New York educational agencies.
Implementation Tiers, which indicate how an organization manages cybersecurity risks.
The CSF does not provide a single set of requirements, but rather, by following its process, enables individual organizations to develop their own cybersecurity protocols designed to meet their needs. The process essentially provides a means to conduct a thorough audit of an organization’s cybersecurity issues and needs in order to inform the determination of how those needs are best met.
Another new element in the proposed regulation is the requirement to designate one or more employees to serve as the educational agency’s data protection officer(s). The data protection officer is tasked with responsibility for implementation of the policies and procedures required by the statute and implementing regulations, and to serve as the agency’s point of contact for data security and privacy. The officer must have the requisite knowledge, training and experience to administer these functions, and may be fulfilled by a current agency employee who may perform the function in addition to his/her other job duties.
School Districts should note that contracts include those in electronic form, and click wrap agreements used with software licenses, including those downloaded and/or online applications and transactions for educational technologies and other technologies in which a user must agree to terms and conditions prior to using the product or service.
PII shall not be included in public reports or other documents.
The policy must incorporate the protections afforded to parents or eligible students under FERPA and the IDEA, and their implementing regulations.
Application of all restrictions, requirements and safeguards to third-party contractors.
Although Education Law § 2-d(5) requires the Commissioner of Education to develop one or more model policies, no model has as yet been released.
Training for Educational Agency EmployeesEducational agencies will be mandated to provide annual information privacy and security awareness training to their officers and employees who have access to PII. The training may be provided using online training tools, and may be included in other training already offered.
The proposed regulations reiterate that educational agencies must publish on their websites a parent’s bill of rights for data privacy and security, as required by Education Law § 2-d(3). Additionally, the parent’s bill of rights must be included with every contract with a third-party contractor that receives PII.
Address encryption of the data to help ensure data is protected while in transit or in its custody.
This supplemental information must also be published in the educational agency’s website, but may be redacted as necessary to safeguard the privacy or security of the agency’s data and/or technology infrastructure.
Complies with Education Law § 2-d.
7. Not sell PII or use or disclose it for any marketing or commercial purpose or facilitate or permit its use or disclosure by any other party for any marketing or commercial purpose.
The proposed regulations set forth timelines for notifications of breach or unauthorized release of PII and for investigations thereof. Third-party contractors must promptly notify an educational agency of any breach or unauthorized release of PII no later than seven (7) calendar days after discovery of a breach. An educational agency must report every discovery or report of a breach or unauthorized release of data, including reports from third-party contractors, no more than ten (10) calendar days thereafter, to the Chief Privacy Officer in a format prescribed by the New York State Education Department.
Contact information for representatives who can assist parents or eligible students who have additional questions.
Third-party contractors must cooperate with educational agencies and law enforcement to protect the integrity of investigations regarding breach or unauthorized release of PII. If a breach or unauthorized release is attributed to a third-party contractor, such contractor shall either pay for or promptly reimburse the educational agency for the full cost of its required notifications.
The Chief Privacy Officer must report any breach or unauthorized release of PII to law enforcement if the incident is believed to constitute criminal conduct.
The proposed regulations require that educational agencies establish and disseminate procedures for parents and eligible students to file complaints about breaches or unauthorized releases of student data. Those procedures must include prompt acknowledgement of receipt of complaints, an investigation into such complaints, and follow-up with precautions necessary to protect any PII. Except in extenuating circumstances, the complainant must be provided with a report of the findings within 30 calendar days. Much like procedures pursuant to the Freedom of Information Law, where the timeline cannot be met, the complainant must be provided a written explanation that includes the approximate date when the report will be released. Educational agencies are also required to keep a record of all complaints and their resulting dispositions.
The proposed regulations reiterate from the statute that, consistent with FERPA, parents and students have the right to inspect and review a student’s education record. Requests to do so must be made directly to the educational agency, not to a third-party contractor, in a manner the agency prescribes. Each educational agency must require identification or verification of the identity of the parent or eligible student requesting such access. Compliance with a request must occur within forty-five calendar days after receipt. If the parent consents, the records may be delivered electronically, however, PII must be transmitted in a way that complies with New York State and federal law and regulations. Safeguards associated with industry standards and best practices, including but not limited to encryption and password protection, must be in place when education records requested by a parent or eligible student are transmitted electronically. Parents must be provided annual notification of their right to inspect and review their child’s education record; however the agency’s annual FERPA notice will satisfy this requirement. No duplicate notice pursuant to Education Law § 2-d is required.
The proposed regulations note the civil penalties set forth in Education Law § 2-d for breach or unauthorized release of student data or teacher or principal data by third-party contractors. Incidents are to be investigated by the Chief Privacy Officer. Penalties include restrictions on access to PII for up to five years either with regard to the affected educational agency or throughout New York, restrictions on public bidding for up to five years, requiring training for third-party contractor employees and agents in the handling of PII, and monetary fines.
Finally, the proposed regulations elaborate on the Chief Privacy Officer’s powers. The Chief Privacy Officer’s authority to access educational agency records relating to student data or teacher or principal data includes, but is not limited to, records related to any technology product or service that will be utilized to store and/or process PII. Further, the Chief Privacy Officer may require an educational agency to act to ensure that PII is protected as required by New York and federal laws and regulations. This includes the authority to require an educational agency to conduct a privacy and security risk assessment.
Educational agencies should start developing or reviewing their policies to prepare for implementation of the proposed regulations and ensure that their agreements with third-party contractors that receive PII comply with the statute and implementing regulations. Revisiting security protocols for protection of PII, whether stored on paper or electronically, can help prevent any breach or unauthorized release.
Should you have any questions or concerns regarding this legal alert or require assistance with updating your Parents’ Bill of Rights for Data Privacy and Security, developing/reviewing your policy, or updating contracts, please feel free to contact Stephanie Burns or Susan Fine.

References: § 2
 § 2
 § 2
 §99
 § 1400
 § 300
 § 2
 § 2
 § 2
 § 2
 § 2
 § 2