Serves K-12 schools, in New York

8 NYCRR § 121.10(a), (c) and (f) · Read the law's page

• If you are a third-party contractor that receives student data or teacher or principal data from a New York educational agency, notify each educational agency you contract with of any breach or unauthorized release of personally identifiable information in the most expedient way possible and without unreasonable delay, and no more than seven calendar days after you discover it (8 NYCRR 121.10(a)).
• Cooperate with educational agencies and law enforcement to protect the integrity of investigations into the breach or unauthorized release (8 NYCRR 121.10(c)).
• Where a breach or unauthorized release is attributed to you, pay for or promptly reimburse the educational agency for the full cost of the notification it must give (8 NYCRR 121.10(f)).

8 NYCRR §§ 121.1(d), 121.6 and 121.9 · Read the law's page

• Treat a click wrap agreement, or other terms a New York educational agency's user must accept before using your software or online service, as a contract that brings Education Law section 2-d and Part 121 into play when you receive student data or teacher or principal data under it (8 NYCRR 121.1(d)).
• Adopt technologies, safeguards and practices that align with the NIST Cybersecurity Framework, and comply with the data security and privacy policy of each educational agency you contract with (8 NYCRR 121.9(a)(1) and (2)).
• Limit internal access to personally identifiable information to the employees or sub-contractors who need it to provide the contracted services, and do not use it for any purpose your contract does not explicitly authorize (8 NYCRR 121.9(a)(3) and (4)).
• Do not disclose personally identifiable information to any other party without the prior written consent of the parent or eligible student, except to your authorized representatives carrying out the contract, or where a statute or court order requires it and you notify the department, district board of education or institution that provided the information no later than the disclosure (8 NYCRR 121.9(a)(5)).
• Maintain reasonable administrative, technical and physical safeguards, and encrypt personally identifiable information in your custody while in motion and at rest (8 NYCRR 121.9(a)(6) and (7)).
• Do not sell personally identifiable information, and do not use or disclose it, or let any other party use or disclose it, for any marketing or commercial purpose, including advertising or developing, improving or marketing products or services to students (8 NYCRR 121.9(a)(8) and 121.1(c)).
• Apply the data protection obligations you carry under state and federal law and your contract to any subcontractor you engage to perform the contract (8 NYCRR 121.9(b)).
• Give each educational agency you contract with a data security and privacy plan it accepts, specifying your safeguards, the training of your officers and employees, how you manage subcontractors, how you handle incidents and notify the agency, and how data is returned, transitioned or destroyed when the contract ends (8 NYCRR 121.6(a)).

N.Y. Educ. Law § 2-d(3), (5)(c) to (e) and (6)(b) · Read the law's page

• If you are an educational agency (a school district, board of cooperative educational services, school or the State Education Department), publish a parents bill of rights for data privacy and security on your website and include it with every contract you enter into with a third party contractor that receives student data or teacher or principal data (Educ. Law 2-d(3)(a)).when it serves a public body
• Include in the bill of rights for each such contract supplemental information stating the exclusive purposes for which the data will be used, how the contractor will ensure that its subcontractors abide by data protection and security requirements, when the agreement expires and what happens to the data then, how a parent, student, teacher or principal may challenge the accuracy of the data, and where the data will be stored and how it will be protected (Educ. Law 2-d(3)(c)).for a public body
• Ensure each contract under which a third party contractor will receive student data or teacher or principal data includes a data security and privacy plan, with a signed copy of the parents bill of rights and a requirement that the contractor's officers and employees with access to the data be trained on the federal and state law governing its confidentiality before they receive access (Educ. Law 2-d(5)(e)).for a public body
• Ensure your contracts with third party contractors, or separate data sharing and confidentiality agreements, require the contractor to maintain the confidentiality of shared student data or teacher or principal data in accordance with federal and state law and your policy on data security and privacy (Educ. Law 2-d(5)(d)).for a public body
• Have a policy on data security and privacy that is consistent with state and federal law, publish it on your website if you have one, and give notice of it to all of your officers and employees (Educ. Law 2-d(5)(c)).when it serves a public body
• After an unauthorized release of student data, notify the parent or eligible student, and after an unauthorized release of teacher or principal data notify each affected teacher or principal, in the most expedient way possible and without unreasonable delay; after a contractor tells you of a breach, report it to the chief privacy officer (Educ. Law 2-d(6)(a) and (b)).when it serves a public body
• School districts must not report to the State Education Department student biometric information, juvenile delinquency records, criminal records or medical and health records, except as required by law or in the case of educational enrollment data (Educ. Law 2-d(4)(e)).when it serves a public body
• Do not sell personally identifiable information you maintain, including data you provide to third-party contractors, and do not use it for marketing purposes (Educ. Law 2-d(4)(f)).for a public body
• If you are the State Education Department's chief privacy officer, publish on the department's website, and keep updated, an inventory and understandable description of the student, teacher and principal data elements collected, with the reasons and legal or regulatory authority for collecting them and their intended uses and disclosure (Educ. Law 2-d(4)(b)).when it serves a public body
• If you are an approved private school for the education of students with disabilities, an approved provider of preschool special education or another school the section names that is not a public body, the duties above bind you as an educational agency too (Educ. Law 2-d(1)(c) and (e)).

N.Y. Educ. Law § 2-d(4)(f) and (5)(f) · Read the law's page

• If you receive student data or teacher or principal data from a New York school district, board of cooperative educational services, school or the State Education Department under a contract or other written agreement, limit internal access to education records to individuals determined to have legitimate educational interests (Educ. Law 2-d(5)(f)(1)).
• Do not use the education records for any purpose other than those explicitly authorized in your contract (Educ. Law 2-d(5)(f)(2)).
• Do not disclose personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless a statute or court order requires the disclosure and you give notice of it to the department, district board of education or institution that provided the information no later than the time of disclosure; your authorized representatives carrying out the contract are excepted (Educ. Law 2-d(5)(f)(3)).
• Maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of the personally identifiable student information in your custody, and use encryption technology to protect data while in motion or in your custody from unauthorized disclosure, using a technology or methodology the United States Department of Health and Human Services specifies in guidance under section 13402(h)(2) of Public Law 111-5 (Educ. Law 2-d(5)(f)(4) and (5)).
• Do not sell personally identifiable information maintained by an educational agency, including data provided to you as a third-party contractor or to your assignees, and do not use it for marketing purposes (Educ. Law 2-d(4)(f)).

N.Y. Educ. Law § 2-d(6)(a), (c) and (d) · Read the law's page

• If you are a third party contractor that receives student data or teacher or principal data under a contract or other written agreement with a New York educational agency, notify the educational agency of any breach of security resulting in an unauthorized release of that data by you or your assignees, in the most expedient way possible and without unreasonable delay (Educ. Law 2-d(6)(a)).
• When the educational agency must notify a parent, eligible student, teacher or principal because of an unauthorized release of data by you or your assignee, promptly reimburse the agency for the full cost of the notification (Educ. Law 2-d(6)(c)).

N.Y. State Tech. Law § 106-b · Read the law's page

• If you are a public elementary or secondary school, including a charter school, do not purchase or use biometric identifying technology for any purpose, including school security, except as the commissioner of education has authorized or for the employee uses State Technology Law 106-b(2)(b) allows; under the commissioner's 2023 order do not purchase or use facial recognition technology until a superseding order issues, and before deciding locally to use other biometric identifying technology consider its privacy implications, its impact on civil rights, its effectiveness and parental input (State Tech. Law 106-b(2)(a)).
• If you are a nonpublic elementary or secondary school, do not purchase or use biometric identifying technology for any purpose, including school security, except as the commissioner of education has authorized or for the employee uses State Technology Law 106-b(2)(b) allows; under the commissioner's 2023 order do not purchase or use facial recognition technology until a superseding order issues, and before deciding locally to use other biometric identifying technology consider its privacy implications, its impact on civil rights, its effectiveness and parental input (State Tech. Law 106-b(2)(a)).
• Schools may use biometric identifying technology only to fingerprint prospective school employees where the education law or the commissioner's regulations require it, or to identify employees who have consented in writing or whose employee organization has consented in writing (State Tech. Law 106-b(2)(b)).
• If you bought facial recognition technology products, or products with that capability, with Smart Schools Bond Act funds before December 20, 2020, stop using the technology and certify that you have stopped, if you have not already done so (order of the Commissioner of Education, 2023).