Law / United States / 
New York
Education Law section 2-d, duties of an educational agency: parents bill of rights, contract terms, data security and privacy policy and notice to parents
N.Y. Educ. Law § 2-d(3), (5)(c) to (e) and (6)(b)
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Contract terms, Disclosure, Breach notice, Security
- Audit expectation
- none
What it requires
- If you are an educational agency (a school district, board of cooperative educational services, school or the State Education Department), publish a parents bill of rights for data privacy and security on your website and include it with every contract you enter into with a third party contractor that receives student data or teacher or principal data (Educ. Law 2-d(3)(a)).
- Include in the bill of rights for each such contract supplemental information stating the exclusive purposes for which the data will be used, how the contractor will ensure that its subcontractors abide by data protection and security requirements, when the agreement expires and what happens to the data then, how a parent, student, teacher or principal may challenge the accuracy of the data, and where the data will be stored and how it will be protected (Educ. Law 2-d(3)(c)).
- Ensure each contract under which a third party contractor will receive student data or teacher or principal data includes a data security and privacy plan, with a signed copy of the parents bill of rights and a requirement that the contractor's officers and employees with access to the data be trained on the federal and state law governing its confidentiality before they receive access (Educ. Law 2-d(5)(e)).
- Ensure your contracts with third party contractors, or separate data sharing and confidentiality agreements, require the contractor to maintain the confidentiality of shared student data or teacher or principal data in accordance with federal and state law and your policy on data security and privacy (Educ. Law 2-d(5)(d)).
- Have a policy on data security and privacy that is consistent with state and federal law, publish it on your website if you have one, and give notice of it to all of your officers and employees (Educ. Law 2-d(5)(c)).
- After an unauthorized release of student data, notify the parent or eligible student, and after an unauthorized release of teacher or principal data notify each affected teacher or principal, in the most expedient way possible and without unreasonable delay; after a contractor tells you of a breach, report it to the chief privacy officer (Educ. Law 2-d(6)(a) and (b)).
- School districts must not report to the State Education Department student biometric information, juvenile delinquency records, criminal records or medical and health records, except as required by law or in the case of educational enrollment data (Educ. Law 2-d(4)(e)).
- Do not sell personally identifiable information you maintain, including data you provide to third-party contractors, and do not use it for marketing purposes (Educ. Law 2-d(4)(f)).
- If you are the State Education Department's chief privacy officer, publish on the department's website, and keep updated, an inventory and understandable description of the student, teacher and principal data elements collected, with the reasons and legal or regulatory authority for collecting them and their intended uses and disclosure (Educ. Law 2-d(4)(b)).
- If you are an approved private school for the education of students with disabilities, an approved provider of preschool special education or another school the section names that is not a public body, the duties above bind you as an educational agency too (Educ. Law 2-d(1)(c) and (e)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 2-d lists the terms and policies an educational agency must put in place and names no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 2-d(1)(c) defines an educational agency as a school district, board of cooperative educational services, school, or the education department. Section 2-d(1)(e) defines a school to include, besides public elementary and secondary schools, an approved private school for the education of students with disabilities and an approved provider of preschool special education.
Section 2-d(3)(a) requires a parents bill of rights for data privacy and security to be published on each educational agency's website and included with every contract the agency enters into with a third party contractor that receives student data or teacher or principal data.
Section 2-d(3)(b) requires the bill of rights to state that a student's personally identifiable information cannot be sold or released for any commercial purposes, that parents may inspect and review the complete contents of their child's education record, that safeguards such as encryption, firewalls and password protection must be in place when data is stored or transferred, where the complete list of student data elements collected by the State is available, and where to direct complaints about possible breaches of student data.
Section 2-d(3)(c) requires supplemental information for each such contract, including the exclusive purposes for which the data will be used, what happens to the data when the agreement expires, and where the data will be stored and how it will be protected.
Section 2-d(5)(e) requires each educational agency that contracts with a third party contractor to ensure the contract includes a data security and privacy plan, with a signed copy of the parents bill of rights and a requirement that the contractor's officers and employees with access to student data be trained on the governing confidentiality law before access.
Section 2-d(5)(d) requires each educational agency to have provisions in its contracts with third party contractors, or in separate data sharing and confidentiality agreements, that require confidentiality of the shared data to be maintained in accordance with federal and state law and the agency's policy on data security and privacy.
Section 2-d(5)(c) requires each educational agency to have a policy on data security and privacy, published on its website if it exists, and to give notice of the policy to all of its officers and employees. Section 2-d(6)(a) requires the educational agency, on notification by a third party contractor, to report the breach of security and unauthorized release to the chief privacy officer.
Under section 2-d(6)(b), after an unauthorized release of student data the educational agency must notify the parent or eligible student in the most expedient way possible and without unreasonable delay, and after an unauthorized release of teacher or principal data it must notify each affected teacher or principal.
Section 2-d(4)(e) bars school districts from reporting to the department student biometric information, juvenile delinquency records, criminal records and medical and health records, except as required by law or for educational enrollment data. Section 2-d(4)(f) provides that personally identifiable information maintained by educational agencies, including data provided to third-party contractors and their assignees, shall not be sold or used for marketing purposes.
Section 2-d(4)(b) requires the chief privacy officer to develop, regularly update and publish on the department's website an inventory and understandable description of the student, teacher and principal data elements collected, with the reasons and legal or regulatory authority for collecting them and their intended uses and disclosure.
Part 121 adopted the National Institute of Standards and Technology Cybersecurity Framework 2.0 as the standard for educational agency privacy and security programs and policies.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .