Law / United States / 
New York
Regulations of the Commissioner of Education Part 121, duties of a third-party contractor that receives student data or teacher or principal data
8 NYCRR §§ 121.1(d), 121.6 and 121.9
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Consent, Contract terms
- Audit expectation
- none
What it requires
- Treat a click wrap agreement, or other terms a New York educational agency's user must accept before using your software or online service, as a contract that brings Education Law section 2-d and Part 121 into play when you receive student data or teacher or principal data under it (8 NYCRR 121.1(d)).
- Adopt technologies, safeguards and practices that align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and comply with the data security and privacy policy of each educational agency you contract with (8 NYCRR 121.9(a)(1) and (2)).
- Limit internal access to personally identifiable information to the employees or sub-contractors who need it to provide the contracted services, and do not use it for any purpose your contract does not explicitly authorize (8 NYCRR 121.9(a)(3) and (4)).
- Do not disclose personally identifiable information to any other party without the prior written consent of the parent or eligible student, except to your authorized representatives carrying out the contract, or where a statute or court order requires it and you notify the department, district board of education or institution that provided the information no later than the disclosure (8 NYCRR 121.9(a)(5)).
- Maintain reasonable administrative, technical and physical safeguards, and encrypt personally identifiable information in your custody while in motion and at rest (8 NYCRR 121.9(a)(6) and (7)).
- Do not sell personally identifiable information, and do not use or disclose it, or let any other party use or disclose it, for any marketing or commercial purpose, including advertising or developing, improving or marketing products or services to students (8 NYCRR 121.9(a)(8) and 121.1(c)).
- Apply the data protection obligations you carry under state and federal law and your contract to any subcontractor you engage to perform the contract (8 NYCRR 121.9(b)).
- Give each educational agency you contract with a data security and privacy plan it accepts, specifying your safeguards, the training of your officers and employees, how you manage subcontractors, how you handle incidents and notify the agency, and how data is returned, transitioned or destroyed when the contract ends (8 NYCRR 121.6(a)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Sections 121.1(d), 121.6 and 121.9 set contract, security and use limits for a third-party contractor and name no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Part 121 of the Regulations of the Commissioner of Education implements Education Law section 2-d and took effect on . Section 121.1(d) defines a contract or other written agreement to include an agreement signed electronically and a click wrap agreement used with software licenses, downloaded or online applications and transactions for educational technologies in which a user must agree to terms and conditions before using the product or service.
Section 121.9(a) requires each third-party contractor that will receive student data or teacher or principal data to adopt technologies, safeguards and practices that align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework, to comply with the educational agency's data security and privacy policy, Education Law section 2-d and Part 121, and to limit internal access to personally identifiable information to the employees or sub-contractors who need it to provide the contracted services.
The contractor may not use personally identifiable information for any purpose its contract does not explicitly authorize, may not disclose it without the prior written consent of the parent or eligible student except to its authorized representatives carrying out the contract or where a statute or court order requires disclosure and notice is given, must keep reasonable administrative, technical and physical safeguards, and must encrypt the information in its custody in motion and at rest.
Section 121.9(a)(8) bars the contractor from selling personally identifiable information or using or disclosing it for any marketing or commercial purpose, which section 121.1(c) defines to include using student data for advertising purposes or to develop, improve or market products or services to students.
Under section 121.9(b), where the contractor engages a subcontractor to perform its contractual obligations, the data protection obligations that state and federal law and the contract impose on the contractor apply to the subcontractor.
Section 121.6(a) requires each educational agency to ensure its contract with a third-party contractor includes the contractor's data security and privacy plan, which must specify the contractor's safeguards, the training of its officers and employees, its use of subcontractors, how it will manage incidents and notify the agency, and whether, how and when data will be returned, transitioned or destroyed when the contract ends.
The State Education Department's guidance states that Part 121 adopted the National Institute of Standards and Technology Cybersecurity Framework 2.0 as the standard for educational agency privacy and security programs and policies.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .