Law / United States / 
New York
Regulations of the Commissioner of Education Part 121, duties of an educational agency: data minimization, bill of rights supplement, data security and privacy policy, training and Data Protection Officer
8 NYCRR §§ 121.2(b), 121.3(d), 121.5, 121.7 and 121.8
In force since .
A sensitive categories rule binding government bodies.
- Obligation class
- Disclosure, Governance, Security
- Audit expectation
- none
What it requires
- If you are an approved private school for the education of students with disabilities, an approved provider of preschool special education or a charter school, Part 121 binds you as an educational agency, as it does a school district, a board of cooperative educational services and the State Education Department (8 NYCRR 121.1(g) and (o)).
- Take steps to minimize your collection, processing and transmission of personally identifiable information (8 NYCRR 121.2(b)).
- Publish on your website the supplement to the parents bill of rights for each contract or other written agreement with a third-party contractor that will receive personally identifiable information (8 NYCRR 121.3(d)).
- Adopt and publish a data security and privacy policy that implements Part 121 and aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework the Department adopts as the standard for educational agencies (8 NYCRR 121.5(a) and (b)).
- Make the policy address two protections: every use and disclosure of personally identifiable information by you must benefit students and you, and personally identifiable information must not be included in public reports or other documents (8 NYCRR 121.5(c)).
- Include in the policy all the protections afforded to parents or eligible students, where applicable, under the Family Educational Rights and Privacy Act and the Individuals with Disabilities Education Act and their implementing federal regulations (8 NYCRR 121.5(d)).
- Publish the policy on your website and give notice of it to all your officers and employees (8 NYCRR 121.5(e)).
- Provide data privacy and security awareness training every year to your officers and employees with access to personally identifiable information; the training should include the state and federal laws that protect it and how employees can comply with them (8 NYCRR 121.7).
- Designate a Data Protection Officer, who may be a current employee with other job responsibilities, to be responsible for implementing the policies and procedures required by Education Law section 2-d and Part 121 and to serve as your point of contact for data security and privacy; the officer must have the appropriate knowledge, training and experience to administer those functions (8 NYCRR 121.8).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Sections 121.2(b), 121.3(d), 121.5, 121.7 and 121.8 set minimization, publication, policy, training and officer duties for an educational agency and name no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Part 121 of the Regulations of the Commissioner of Education implements Education Law section 2-d and took effect on . Section 121.1(g) defines an educational agency as a school district, board of cooperative educational services, school or the Department. Section 121.1(o) defines a school to include a charter school, an approved provider of preschool special education and an approved private school for the education of students with disabilities.
Section 121.2(b) requires each educational agency to take steps to minimize its collection, processing and transmission of personally identifiable information. Section 121.3(d) requires each educational agency to publish on its website the supplement to the parents bill of rights for any contract or other written agreement with a third-party contractor that will receive personally identifiable information.
Section 121.5(a) adopts the National Institute of Standards and Technology (NIST) Cybersecurity Framework as the standard for data security and privacy for educational agencies. Section 121.5(b) requires each educational agency to adopt and publish a data security and privacy policy that implements the requirements of Part 121 and aligns with the NIST Cybersecurity Framework.
Under section 121.5(c) the policy must address two protections, that every use and disclosure of personally identifiable information by the agency benefits students and the agency, and that personally identifiable information is not included in public reports or other documents.
Section 121.5(d) requires the policy to include all the protections afforded to parents or eligible students, where applicable, under the Family Educational Rights and Privacy Act and the Individuals with Disabilities Education Act and their implementing federal regulations. Section 121.5(e) requires each educational agency to publish its policy on its website and to give notice of the policy to all its officers and employees.
Section 121.7 requires educational agencies to provide data privacy and security awareness training every year to their officers and employees with access to personally identifiable information. The training should include training on the state and federal laws that protect personally identifiable information and on how employees can comply with them.
Section 121.8(a) requires each educational agency to designate a Data Protection Officer to be responsible for implementing the policies and procedures required by Education Law section 2-d and Part 121 and to serve as the agency's point of contact for data security and privacy.
Under section 121.8(b) a Data Protection Officer must have the appropriate knowledge, training and experience to administer those functions, and under section 121.8(c) a current employee of the agency may perform the function in addition to other job responsibilities.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .