New York Codes, Rules and Regulations › Title 8 - EDUCATION DEPARTMENT › Chapter II - Regulations of the Commissioner › Subchapter E - Elementary and Secondary Education › Part 121 - Strengthening Data Privacy and Security in NY State Educational Agencies to Protect Personally Identifiable Information › Section 121.1 - Definitions

Current through Register Vol. 46, No. 28, July 10, 2024
As used in this Part, the following terms shall have the
					 following meanings:
(a) Breach means
				  the unauthorized acquisition, access, use, or disclosure of student data and/or
				  teacher or principal data by or to a person not authorized to acquire, access,
				  use, or receive the student data and/or teacher or principal data.
(b) Chief Privacy Officer means the Chief
				  Privacy Officer appointed by the Commissioner pursuant to Education Law §
										2-d.
(c) Commercial or Marketing Purpose means the
				  sale of student data; or its use or disclosure for purposes of receiving
				  remuneration, whether directly or indirectly; the use of student data for
				  advertising purposes, or to develop, improve or market products or services to
				  students.
(d) Contract or other
				  written agreement means a binding agreement between an educational agency and a
				  third-party, which shall include but not be limited to an agreement created in
				  electronic form and signed with an electronic or digital signature or a click
				  wrap agreement that is used with software licenses, downloaded and/or online
				  applications and transactions for educational technologies and other
				  technologies in which a user must agree to terms and conditions prior to using
				  the product or service.
(e)
				  Disclose or Disclosure mean to permit access to, or the release, transfer, or
				  other communication of personally identifiable information by any means,
				  including oral, written, or electronic, whether intended or
				  unintended.
(f) Education Records
				  means an education record as defined in the Family Educational Rights and
				  Privacy Act and its implementing regulations,
				  20 U.S.C.
				  1232g and   34 C.F.R. Part 99, respectively.
(g) Educational
				  Agency means a school district, board of cooperative educational services
				  (BOCES), school, or the Department.
(h) Eligible Student means a student who is
				  eighteen years or older.
(i)
				  Encryption means methods of rendering personally identifiable information
				  unusable, unreadable, or indecipherable to unauthorized persons through the use
				  of a technology or methodology specified or permitted by the Secretary of the
				  United States department of health and human services in guidance issued under
				  Section
				  13402(H)(2) of
				  Public
				  Law 111-5.
(j) FERPA means the Family Educational Rights
				  and Privacy Act and its implementing regulations,
				  20 U.S.C.
				  1232g and 34 C.F.R. Part 99,
				  respectively.
(k) NIST
				  Cybersecurity Framework means the U.S. Department of Commerce National
				  Institute for Standards and Technology Framework for Improving Critical
				  Infrastructure Cybersecurity Version 1.1 which is available at the Office of
				  Counsel, State Education Department, State Education Building, Room 148, 89
				  Washington Avenue, Albany, New York 12234.
(l) Parent means a parent, legal guardian, or
				  person in parental relation to a student.
(m) Personally Identifiable Information, as
				  applied to student data, means personally Identifiable information as defined
				  in section 99.3 of Title 34 of the Code of Federal Regulations implementing the
				  Family Educational Rights and Privacy Act,
				  20 U.S.C
				  1232g, and as applied to teacher and
				  principal data, means personally identifiable information as such term is
				  defined in Education Law §
										3012-c(10).
(n) Release shall have the same meaning as
				  Disclosure or Disclose.
(o) School
				  means any public elementary or secondary school including a charter school,
				  universal pre-kindergarten program authorized pursuant to Education Law §
										3602-e, an approved provider of preschool
				  special education, any other publicly funded pre-kindergarten program, a school
				  serving children in a special act school district as defined in Education Law §
										4001, an
				  approved private school for the education of students with disabilities, a
				  State-supported school subject to the provisions of Article 85 of the Education
				  Law, or a State-operated school subject to the provisions of Articles 87 or 88
				  of the Education Law.
(p) Student
				  means any person attending or seeking to enroll in an educational
				  agency.
(q) Student Data means
				  personally identifiable information from the student records of an educational
				  agency.
(r) Teacher or Principal
				  Data means personally identifiable information from the records of an
				  educational agency relating to the annual professional performance reviews of
				  classroom teachers or principals that is confidential and not subject to
				  release under the provisions of Education Law §§
										3012-c and
				  3012-d.
(s) Third-Party Contractor means any person
				  or entity, other than an educational agency, that receives student data or
				  teacher or principal data from an educational agency pursuant to a contract or
				  other written agreement for purposes of providing services to such educational
				  agency, including but not limited to data management or storage services,
				  conducting studies for or on behalf of such educational agency, or audit or
				  evaluation of publicly funded programs. Such term shall include an educational
				  partnership organization that receives student and/or teacher or principal data
				  from a school district to carry out its responsibilities pursuant to Education
				  Law §
										211-e and is not an educational agency,
				  and a not-for-profit corporation or other nonprofit organization, other than an
				  educational agency.
(t)
				  Unauthorized Disclosure or Unauthorized Release means any disclosure or release
				  not permitted by federal or State statute or regulation, any lawful contract or
				  written agreement, or that does not respond to a lawful order of a court or
				  tribunal or other lawful order.