Law / United States / 
New York
Regulations of the Commissioner of Education Part 121, breach complaints and breach reports and notices by an educational agency
8 NYCRR §§ 121.4 and 121.10(b), (d) and (e)
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice, Reporting, Governance
- Audit expectation
- none
What it requires
- Establish and communicate to parents, eligible students, teachers, principals and other staff your procedures for filing complaints about breaches or unauthorized releases of student data or teacher or principal data (8 NYCRR 121.4(a)).
- Require those procedures to provide that you promptly acknowledge receipt of a complaint, commence an investigation and take the necessary precautions to protect personally identifiable information (8 NYCRR 121.4(b)).
- After investigating a complaint, give the person who filed it your findings within a reasonable period and no more than 60 calendar days after you receive it; where you need more time, or the response may compromise security or impede a law enforcement investigation, give a written explanation that includes the approximate date you anticipate responding (8 NYCRR 121.4(c)).
- Keep a record of all complaints of breaches or unauthorized releases of student data and their disposition, in accordance with applicable data retention policies (8 NYCRR 121.4(e)).
- When a third-party contractor notifies you of a breach or unauthorized release, notify the Chief Privacy Officer no more than 10 calendar days after you receive the notification, using the form or format the Department prescribes (8 NYCRR 121.10(b)).
- Report every discovery or report of a breach or unauthorized release of student, teacher or principal data to the Chief Privacy Officer without unreasonable delay and no more than 10 calendar days after the discovery (8 NYCRR 121.10(d)).
- Notify affected parents, eligible students, teachers and principals in the most expedient way possible and without unreasonable delay, and no more than 60 calendar days after you discover a breach or unauthorized release or receive a contractor's notification of one, unless the notification would interfere with an ongoing law enforcement investigation or disclose an unfixed security vulnerability (8 NYCRR 121.10(e)).
- Where that notification is delayed, notify them within seven calendar days after the security vulnerability has been remedied or the risk of interference with the law enforcement investigation ends (8 NYCRR 121.10(e)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 121.4(e) requires an educational agency to maintain a record of all complaints of breaches or unauthorized releases of student data and their disposition, and names no fields the record must hold.
- Kind
- Explicit
- As of
- Provision
- 8 NYCRR 121.4(e)
- Trigger
- security_incident
What this law does
Part 121 of the Regulations of the Commissioner of Education implements Education Law section 2-d and took effect on . Section 121.1(g) defines an educational agency as a school district, board of cooperative educational services, school or the Department. Section 121.1(a) defines a breach as the unauthorized acquisition, access, use or disclosure of student data or teacher or principal data by or to a person not authorized to acquire, access, use or receive it.
Section 121.4(a) requires each educational agency to establish and communicate to parents, eligible students, teachers, principals and other staff its procedures for filing complaints about breaches or unauthorized releases of student data or teacher or principal data. Under section 121.4(b) the complaint procedures must require the agency to promptly acknowledge receipt of a complaint, commence an investigation and take the necessary precautions to protect personally identifiable information.
Section 121.4(c) requires the agency, following its investigation, to give the person who filed the complaint its findings within a reasonable period and no more than 60 calendar days from the agency's receipt of the complaint. Where the agency requires additional time, or where the response may compromise security or impede a law enforcement investigation, section 121.4(c) requires it to give the person a written explanation that includes the approximate date by which it anticipates responding.
Section 121.4(e) requires educational agencies to maintain a record of all complaints of breaches or unauthorized releases of student data and their disposition in accordance with applicable data retention policies. Section 121.10(b) requires each educational agency to notify the Chief Privacy Officer of a breach or unauthorized release no more than 10 calendar days after it receives the third-party contractor's notification, using a form or format prescribed by the Department.
Section 121.10(d) requires educational agencies to report every discovery or report of a breach or unauthorized release of student, teacher or principal data to the Chief Privacy Officer without unreasonable delay and no more than 10 calendar days after the discovery.
Section 121.10(e) requires educational agencies to notify affected parents, eligible students, teachers and principals in the most expedient way possible and without unreasonable delay, and no more than 60 calendar days after the agency discovers a breach or unauthorized release or receives a contractor's notification of one, unless the notification would interfere with an ongoing law enforcement investigation or disclose an unfixed security vulnerability.
Where that notification is delayed, section 121.10(e) requires the agency to notify them within seven calendar days after the security vulnerability has been remedied or the risk of interference with the law enforcement investigation ends.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .