New York Codes, Rules and Regulations › Title 15 - Department of Motor Vehicles › Chapter I - REGULATIONS OF THE COMMISSIONER › Subchapter A - DRIVER LICENSING AND TRAINING › Part 10 - INTERNET PRE-LICENSING COURSE › Section 10.11 - Information Security Guidelines

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Protection of student confidential
				  information is of paramount importance to the Department. Sponsors must ensure
				  client information is kept confidential and secure. This includes securing
				  personal information, as defined by Article 12-D, along with purchase
				  information (such as credit card information), identity information (such as
				  motorist ID, personal information questions and answers), and records
				  maintained to validate student and sponsor compliance with the requirements,
				  including any client reported information on tests and surveys.
(b) Sponsors must comply with the New York
				  State Personal Privacy Protection Law, the Driver Privacy Protection Act
				  (DPPA), and any other state or federal privacy protection laws. In addition,
				  sponsors must comply with NYS Information Security Breach and Notification Act,
				  Sec 208, NYS Technology Law, and Sec. 899-aa NYS General Business
				  Law.
(c) If there is any breach of
				  security, the affected sponsor must notify the Department as soon as possible
				  after the security breach, providing details of the incident(s) and what steps
				  were taken to address the security breach in a timely manner.
(d) The Department will review each sponsor's
				  security plan prior to course approval. After approval has been granted, the
				  Department, the sponsor's monitor or a third-party under contract to the
				  Department, reserves the right to audit the sponsor's internet information
				  security practices, security of office sites, systems and test areas on a
				  periodic basis, or when circumstances as determined by the Department warrant.
				  The sponsor must not rely on the Department's approval of the security plan as
				  an assurance that any or all aspects of the sponsor's internet pre-licensing
				  course are in compliance with state and federal laws.
(e) Sponsors must maintain records for the
				  internet pre-licensing course separately from any other course data, and
				  sponsors must structure their data systems to differentiate between the
				  courses. Course records and data, with the exception of biometric data, must be
				  retained by the sponsor for a period of not less than five (5) years from the
				  date the data was collected, or the date of course completion, whichever is
				  later. Biometric data, facial recognition, key stroke analysis, voice print or
				  fingerprints, must be retained by the sponsor for a minimum of five (5)
				  business days, and no longer than thirty (30) calendar days from the date the
				  data was collected, or the date of course completion, whichever is
				  later.
(f) Sponsors that are
				  approved by the Department to offer internet pre-licensing courses in languages
				  other than English must be able to delineate between courses provided in
				  various languages.