Law / United States / 
New York
Regulations of the Commissioner of Education Part 121, powers of the Chief Privacy Officer over an educational agency
In force since .
An enforcement supervision rule binding government bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Records, reports, audits, reviews, documents, papers, recommendations and other materials you maintain that relate to student data or teacher or principal data, including records related to any technology product or service used to store or process personally identifiable information, are open to access by the Chief Privacy Officer (8 NYCRR 121.13(a)).
- After reviewing those records the Chief Privacy Officer may require you to act to ensure that personally identifiable information is protected in accordance with state and federal law and regulations, including by performing a privacy impact and security risk assessment (8 NYCRR 121.13(b)).
These lines are LexLint's reading of the law's text.
What record it asks for
Who may demand the log
Regulator
Logging duty
Section 121.13(a) gives the Chief Privacy Officer access to the records an educational agency maintains on student, teacher or principal data and names no fields and no period for them.
- Kind
- Implicit
- As of
- Provision
- 8 NYCRR 121.13(a)
- Trigger
- personal_data_processing
What this law does
Part 121 of the Regulations of the Commissioner of Education implements Education Law section 2-d and took effect on . Section 121.1(g) defines an educational agency as a school district, board of cooperative educational services, school or the Department.
Section 121.1(b) defines the Chief Privacy Officer as the officer the Commissioner appoints under Education Law section 2-d. Section 121.13(a) gives the Chief Privacy Officer the power to access all records, reports, audits, reviews, documents, papers, recommendations and other materials an educational agency maintains that relate to student data or teacher or principal data, including records related to any technology product or service used to store or process personally identifiable information.
Under section 121.13(b), after reviewing those records the Chief Privacy Officer may require an educational agency to act to ensure that personally identifiable information is protected in accordance with state and federal law and regulations, including by requiring it to perform a privacy impact and security risk assessment.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .