2023 New York Laws › EDN - Education › Title 1 - General Provisions › Article 1 - Short Title and Definitions › 2-D - Unauthorized Release of Personally Identifiable Information.

§ 2-d. Unauthorized release of personally identifiable information. 1.
Definitions.  As used in this section the following terms shall have the
following meanings:
a. "Building principal" means a building principal subject  to  annual
performance  evaluation  review  under  the  provisions of section three
thousand twelve-c of this chapter.
b. "Classroom teacher" means a teacher subject to  annual  performance
evaluation  review  under  the  provisions  of  section  three  thousand
twelve-c of this chapter.
c. "Educational agency" means a school district, board of  cooperative
educational services, school, or the education department.
d.  "Personally identifiable information," as applied to student data,
means personally identifiable information as defined in section 99.3  of
title  thirty-four  of  the code of federal regulations implementing the
family educational  rights  and  privacy  act,  section  twelve  hundred
thirty-two-g  of title twenty of the United States code, and, as applied
to teacher or principal data, means "personally identifying information"
as such term is used  in  subdivision  ten  of  section  three  thousand
twelve-c of this chapter.
e. "School" means any public elementary or secondary school, universal
pre-kindergarten  program  authorized  pursuant  to  section  thirty-six
hundred two-e of this chapter, an approved provider of preschool special
education, any other publicly funded pre-kindergarten program, a  school
serving  children in a special act school district as defined in section
four thousand one of this chapter, an approved private  school  for  the
education  of  students  with  disabilities,  a  state-supported  school
subject to the provisions of article eighty-five of this chapter,  or  a
state-operated  school subject to the provisions of article eighty-seven
or eight-eight of this chapter.
f. "Student" means any person attending or seeking  to  enroll  in  an
educational agency.
g. "Eligible student" means a student eighteen years or older.
h.  "Parent"  means  a  parent,  legal guardian, or person in parental
relation to a student.
i. "Student  data"  means  personally  identifiable  information  from
student records of an educational agency.
j.   "Teacher   or   principal  data"  means  personally  identifiable
information from the records of an educational agency  relating  to  the
annual   professional  performance  reviews  of  classroom  teachers  or
principals that is confidential and not subject  to  release  under  the
provisions of section three thousand twelve-c of this chapter.
k.  "Third  party  contractor"  shall mean any person or entity, other
than an educational agency, that receives student  data  or  teacher  or
principal  data  from  an  educational  agency pursuant to a contract or
other written agreement for  purposes  of  providing  services  to  such
educational  agency,  including  but  not  limited to data management or
storage  services,  conducting  studies  for  or  on  behalf   of   such
educational  agency, or audit or evaluation of publicly funded programs.
Such term shall include an  educational  partnership  organization  that
receives student and/or teacher or principal data from a school district
to  carry  out  its  responsibilities  pursuant  to  section two hundred
eleven-e of this title and is not an educational agency  as  defined  in
paragraph  c  of  this  subdivision, and a not-for-profit corporation or
other non-profit organization, other than an educational agency.
2. Chief privacy officer. a. The commissioner shall  appoint  a  chief
privacy  officer  within the department for a term of three years, which
may be renewed  for  three-year  terms  thereafter.  The  chief  privacy
officer  shall  be  qualified  by  training  or  experience in state and

federal  education  privacy  laws  and  regulations,  civil   liberties,
information  technology,  and  information  security.  The chief privacy
officer shall report to the commissioner on  matters  affecting  privacy
and the security of student, teacher, and principal data.
b.  The  functions of the chief privacy officer shall include, but not
be limited to:
(1) promoting the implementation of sound  information  practices  for
privacy and security of student data or teacher or principal data;
(2)  assisting the commissioner in handling instances of data breaches
as well  as  assisting  the  commissioner  in  due  process  proceedings
regarding  any  alleged breaches of student data or teacher or principal
data;
(3) providing assistance to educational agencies within the  state  on
minimum  standards  and  best  practices associated with privacy and the
security of student data or teacher or principal data;
(4) formulating a procedure within  the  department  whereby  parents,
students,  teachers,  superintendents, school board members, principals,
and other persons or entities the chief privacy  officer  determines  is
appropriate,  may  request  information  pertaining  to  student data or
teacher or principal data in a timely and efficient manner;
(5) assisting the commissioner in  establishing  a  protocol  for  the
submission of complaints of possible breaches of student data or teacher
or principal data;
(6)  making  recommendations  as  needed  regarding  privacy  and  the
security of student data on behalf of the department  to  the  governor,
the  speaker of the assembly, the temporary president of the senate, and
the chairs of the senate and assembly education committees; and
(7) issuing an annual report on data privacy and  security  activities
and  progress,  the number and disposition of reported breaches, if any,
and a summary of any complaint submitted pursuant to  subparagraph  five
of this paragraph.
c. The chief privacy officer shall have the power to:
(1)  access  all records, reports, audits, reviews, documents, papers,
recommendations, and other materials maintained by an educational agency
that relate to student data or teacher or principal data;
(2) to review and  comment  upon  any  department  program,  proposal,
grant,  or  contract  that  involves  the  processing of student data or
teacher or principal data before the commissioner begins or  awards  the
program, proposal, grant, or contract; and
(3) any other powers that the commissioner shall deem appropriate.
3.  Parents bill of rights for data privacy and security. a. A parents
bill of rights for data privacy and security shall be published  on  the
website  of  each  educational  agency  and shall be included with every
contract an educational agency enters into with a third party contractor
where the third party contractor receives student  data  or  teacher  or
principal data.
b.  The  parents  bill  of  rights for data privacy and security shall
state in clear and plain English terms that:
(1) A student's personally identifiable information cannot be sold  or
released for any commercial purposes;
(2) Parents have the right to inspect and review the complete contents
of their child's education record;
(3)  State  and federal laws protect the confidentiality of personally
identifiable  information,  and  safeguards  associated  with   industry
standards  and best practices, including but not limited to, encryption,
firewalls, and password protection, must be in place when data is stored
or transferred;
(4) A complete list of all student  data  elements  collected  by  the
State is available for public review at (insert website address here) or
by writing to (insert mailing address here); and
(5)  Parents have the right to have complaints about possible breaches
of student data addressed. Complaints  should  be  directed  to  (insert
phone number, email and mailing address here).
c.  The  parents  bill  of  rights for data privacy and security shall
include supplemental information for each contract an educational agency
enters into  with  a  third  party  contractor  where  the  third  party
contractor  receives  student  data  or  teacher or principal data. Such
supplemental information shall be developed by  the  educational  agency
and shall include:
(1)  the  exclusive  purposes for which the student data or teacher or
principal data will be used;
(2)  how  the  third   party   contractor   will   ensure   that   the
subcontractors, persons or entities that the third party contractor will
share  the  student data or teacher or principal data with, if any, will
abide by data protection and security requirements;
(3) when the agreement expires and what happens to the student data or
teacher or principal data upon expiration of the agreement;
(4) if and  how  a  parent,  student,  eligible  student,  teacher  or
principal  may  challenge the accuracy of the student data or teacher or
principal data that is collected; and
(5) where the student data or teacher or principal data will be stored
(described in such a manner  as  to  protect  data  security),  and  the
security  protections  taken  to  ensure  such  data  will be protected,
including whether such data will be encrypted.
d. The chief privacy  officer,  with  input  from  parents  and  other
education  and expert stakeholders, shall develop additional elements of
the  parents  bill  of  rights  for  data  privacy  and  security.   The
commissioner  shall  promulgate regulations for a comment period whereby
parents and  other  members  of  the  public  may  submit  comments  and
suggestions to the chief privacy officer to be considered for inclusion.
The  parents  bill  of  rights  for  data  privacy and security shall be
completed within one hundred twenty days after  the  effective  date  of
this section.
4.  Data  collection  transparency and restrictions. a. The department
shall promote the least intrusive data collection  policies  practicable
that  advance  the  goals  of improving academic achievement, empowering
parents with information and advancing efficient  and  effective  school
operations   while   minimizing   the  collection  and  transmission  of
personally identifiable information.
b. The chief privacy officer shall develop, regularly update and  make
publicly   available  on  the  department's  website  and  through  such
additional methods as may  facilitate  accessibility  an  inventory  and
understandable  description  of  the student, teacher and principal data
elements collected  with  an  explanation  and/or  legal  or  regulatory
authority outlining the reasons such data elements are collected and the
intended uses and disclosure of the data.
c.  Except as otherwise specifically authorized by law, the department
shall only collect personally identifiable information  relating  to  an
educational purpose.
d.  The  department  may  only  require districts to submit personally
identifiable  information,  including  data  on  disability  status  and
student  suspensions, where such release is required by law or otherwise
authorized under the family  educational  rights  and  privacy  act,  20
U.S.C. section 1232g, and the personal privacy protection law.
e.  Except as required by law or in the case of educational enrollment
data, school districts shall not report to the department the  following
student data elements:
(1) juvenile delinquency records;
(2) criminal records;
(3) medical and health records; and
(4) student biometric information.
f.  Personally  identifiable  information  maintained  by  educational
agencies, including data provided to third-party contractors  and  their
assignees, shall not be sold or used for marketing purposes.
g.  Parents  shall  have the right to inspect and review their child's
educational record including any student data stored or maintained by an
educational agency. The department shall  develop  policies  for  school
districts that:
(1)  provide  for  annual  notification  to  parents of their right to
request student data;
(2) ensure security when providing student data to parents,  including
that only authorized individuals receive such data; and
(3)  specify  a  reasonable  amount  of time in which school districts
should respond to such requests.
5. Data security  and  privacy  standards.  a.  The  commissioner,  in
consultation   with   the   chief   privacy  officer,  shall  promulgate
regulations establishing standards for educational agency data  security
and  privacy  policies  and shall develop one or more model policies for
use by educational agencies. The commissioner shall seek  the  input  of
experts,  including  those  from  security, cyber-security and fields in
addition  to  education  that  have  experience   with   personal   data
protection, in developing such standards and policies.
b. The standards for data security and privacy policies shall include,
but not be limited to:
(1)  data  privacy  protections,  including  criteria  for determining
whether a proposed use  of  personally  identifiable  information  would
benefit  students and educational agencies, and processes to ensure that
personally identifiable information is not included in public reports or
other public documents;
(2) data security protections, including data systems monitoring, data
encryption, incident response plans, limitations on access to personally
identifiable information, safeguards to ensure  personally  identifiable
information  is  not  accessed  by unauthorized persons when transmitted
over communication networks, and destruction of personally  identifiable
information when no longer needed; and
(3)  application of all such restrictions, requirements and safeguards
to third-party contractors.
c. Following promulgation of regulations by the commissioner  pursuant
to  paragraph a of this subdivision each educational agency shall ensure
that it has a policy on data security  and  privacy  in  place  that  is
consistent with applicable state and federal laws and applied to student
data  and,  where  applicable, to teacher or principal data. Such policy
shall be published on the educational agency's website,  if  it  exists,
and  notice  of  such  policy  shall  be  provided  to  all officers and
employees of the educational agency.
d.  As  applied  to  student  data,  such  policy  shall  provide  all
protections  afforded  to parents and persons in parental relationships,
or students where applicable,  required  under  the  family  educational
rights  and  privacy  act, 20 U.S.C. section 1232g, where applicable the
individuals with disabilities education act, sections fourteen  hundred,
et  seq.  of  title  twenty  of  the United States code, and the federal
regulations implementing such statutes. Each  educational  agency  shall

ensure that it has in place provisions in its contracts with third party
contractors  or  in separate data sharing and confidentiality agreements
that require that confidentiality of the shared student data or  teacher
or principal data be maintained in accordance with federal and state law
and the educational agency's policy on data security and privacy.
e.  Each  educational  agency  that  enters  into  a contract or other
written agreement with a third party contractor under  which  the  third
party  contractor will receive student data or teacher or principal data
shall ensure that such contract or agreement includes  a  data  security
and  privacy  plan  that outlines how all state, federal, and local data
security and privacy contract requirements will be implemented over  the
life of the contract, consistent with the educational agency's policy on
data  security  and  privacy.  Such plan shall include, but shall not be
limited to, a signed copy of the parents bill of rights for data privacy
and security, and a requirement that any officers or  employees  of  the
third party contractor and its assignees who have access to student data
or  teacher  or principal data have received or will receive training on
the federal and state law governing confidentiality of such  data  prior
to receiving access.
f.  Each  third  party contractor that enters into a contract or other
written agreement with an educational agency under which the third party
contractor will receive student data or teacher or principal data shall:
(1) limit internal access to education records  to  those  individuals
that are determined to have legitimate educational interests;
(2)  not  use  the education records for any other purposes than those
explicitly authorized in its contract;
(3)  except  for  authorized  representatives  of  the   third   party
contractor  to  the  extent  they  are  carrying  out  the contract, not
disclose any personally identifiable information to any other party:
(i) without the prior  written  consent  of  the  parent  or  eligible
student; or
(ii)  unless required by statute or court order and the party provides
a notice  of  the  disclosure  to  the  department,  district  board  of
education,  or  institution  that provided the information no later than
the time the information is disclosed, unless providing  notice  of  the
disclosure is expressly prohibited by the statute or court order;
(4)   maintain   reasonable  administrative,  technical  and  physical
safeguards to protect the security,  confidentiality  and  integrity  of
personally identifiable student information in its custody;
(5)  uses  encryption technology to protect data while in motion or in
its  custody  from  unauthorized  disclosure  using  a   technology   or
methodology  specified  by the secretary of the United States department
of  health  and  human  services  in  guidance  issued   under   Section
13402(H)(2) of Public Law 111-5.
6.   Breach   and  unauthorized  release  of  personally  identifiable
information. a. Each third party contractor that receives  student  data
or  teacher  or  principal  data pursuant to a contract or other written
agreement with an educational agency shall be required  to  notify  such
educational   agency   of   any  breach  of  security  resulting  in  an
unauthorized release of such data by the third party contractor  or  its
assignees  in  violation of applicable state or federal law, the parents
bill of rights for student data privacy and security, the  data  privacy
and   security   policies  of  the  educational  agency  and/or  binding
contractual obligations relating to data privacy and  security,  in  the
most   expedient  way  possible  and  without  unreasonable  delay.  The
educational  agency  shall,  upon  notification  by  the   third   party
contractor,  be required to report to the chief privacy officer any such
breach of security and unauthorized release  of  such  data.  The  chief

privacy  officer  shall,  upon  belief that such breach and unauthorized
release  constitutes  criminal   conduct,   report   such   breach   and
unauthorized  release  to  law  enforcement  in  the  most expedient way
possible and without unreasonable delay.
b.  In  the  case  of  an  unauthorized  release  of student data, the
educational agency shall notify the parent or eligible  student  of  the
unauthorized   release   of   student   data  that  includes  personally
identifiable information from the student records of such student in the
most expedient way possible and without unreasonable delay. In the  case
of an unauthorized release of teacher or principal data, the educational
agency   shall   notify  each  affected  teacher  or  principal  of  the
unauthorized release  of  data  that  includes  personally  identifiable
information   from   the  teacher  or  principal's  annual  professional
performance review in  the  most  expedient  way  possible  and  without
unreasonable delay.
c.  In the case of notification to a parent, eligible student, teacher
or  principal  under  paragraph  b  of  this  subdivision  due  to   the
unauthorized  release of student data by a third-party contractor or its
assignee,  the  third-party  contractor  shall  promptly  reimburse  the
educational agency for the full cost of such notification.
d.  Each violation of a third party contractor pursuant to paragraph a
of this subdivision shall be  punishable  by  a  civil  penalty  of  the
greater  of  five  thousand  dollars  or  up to ten dollars per student,
teacher, and principal whose data was released, provided that the latter
amount shall not exceed the  maximum  penalty  under  paragraph  (a)  of
subdivision  six  of section eight hundred ninety-nine-aa of the general
business law.
e. If  the  chief  privacy  officer  determines  that  a  third  party
contractor  or its assignee, in violation of applicable state or federal
law, the data privacy and security policies of  the  educational  agency
provided by such educational agency to the third party contractor and/or
binding  contractual  obligations relating to data privacy and security,
has released any student data or teacher or principal data received from
an educational agency to any person or entity not authorized by  law  to
receive  such data pursuant to a lawful subpoena or otherwise, the chief
privacy officer, after affording the third party contractor with  notice
and an opportunity to be heard, shall be authorized to:
(1)  order that the third party contractor be precluded from accessing
student data or teacher or  principal  data,  as  applicable,  from  the
educational  agency from which the contractor obtained the data that was
improperly disclosed for a fixed period of up to five years; and/or
(2) order that a third party contractor or assignee who  knowingly  or
recklessly  allowed  for  the  unauthorized  release  of student data or
teacher or principal data be precluded from accessing  student  data  or
teacher or principal data from any educational agency in the state for a
fixed period of up to five years; and/or
(3)  order  that a third party contractor or assignee who knowingly or
recklessly allowed for the  unauthorized  release  of  student  data  or
teacher  or  principal  data shall not be deemed a responsible bidder or
offerer on any contract with an educational  agency  that  involves  the
sharing  of student data or teacher or principal data, as applicable for
purposes of the provisions of section one hundred three of  the  general
municipal  law  or paragraph c of subdivision ten of section one hundred
sixty-three of the state finance law, as applicable, for a fixed  period
of up to five years; and/or
(4)  require  the  third  party  contractor to provide training at the
contractor's  expense  on  the   federal   and   state   law   governing
confidentiality of student data and/or teacher or principal data and the

provisions of this section to all its officers and employees with access
to  such  data, prior to being permitted to receive subsequent access to
such data from the educational agency from which the contractor obtained
the  data  that was improperly disclosed or from any educational agency;
and/or
(5) if it is determined that the unauthorized release of student  data
or  teacher  or principal data on the part of the third party contractor
or  assignee  was  inadvertent  and  done  without  intent,   knowledge,
recklessness or gross negligence, the commissioner may determine that no
penalty be issued upon the third party contractor.
7.   Implementation   and   enforcement.   a.   The  commissioner,  in
consultation  with  the  chief   privacy   officer,   shall   promulgate
regulations  establishing procedures to implement the provisions of this
section, including but not limited to procedures for the  submission  of
complaints from parents and/or persons in parental relation to students,
classroom  teachers  or  building  principals,  or  other  staff  of  an
educational agency, making allegations of improper disclosure of student
data and/or teacher or principal data by a third party contractor or its
officers, employees or assignees that may be subject  to  the  sanctions
set  forth  in  subdivision  six  of  this  section.  Upon  receipt of a
complaint  or  other  information  indicating  that  such  an   improper
disclosure  by  a  third  party  contractor may have occurred, the chief
privacy officer shall be authorized to investigate, visit,  examine  and
inspect  the  third party contractor's facilities and records and obtain
documentation from, or require the testimony of, any party  relating  to
the  alleged improper disclosure of student data or teacher or principal
data.
b. Except as provided under paragraph d of  subdivision  six  of  this
section,  each  violation  of  any  provision of this section by a third
party contractor or its assignee shall be punishable by a civil  penalty
of  up  to  one  thousand  dollars; a second violation by the same third
party contractor involving the same student data or teacher or principal
data shall be punishable by a civil  penalty  of  up  to  five  thousand
dollars;  any  subsequent  violation  by the same third party contractor
involving the same student date or teacher or principal  data  shall  be
punishable  by  a  civil  penalty  of  up  to ten thousand dollars. Each
violation of this subdivision shall be considered a  separate  violation
for  purposes  of civil penalties and the total penalty shall not exceed
the maximum penalty under paragraph (a) of subdivision  six  of  section
eight hundred ninety-nine-aa of the general business law.
c.  Nothing contained in this section shall be construed as creating a
private right of action against the department or an educational agency.
d. Nothing in this section  shall  limit  the  administrative  use  of
student data or teacher or principal data by a person acting exclusively
in  the  person's capacity as an employee of an educational agency or of
the state or any of its political subdivisions, any court or the federal
government that is otherwise required by law.