Law / United States / 
New York
Education Law section 2-d, duties of a third party contractor that receives student data or teacher or principal data
N.Y. Educ. Law § 2-d(4)(f) and (5)(f)
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Consent
- Audit expectation
- none
What it requires
- If you receive student data or teacher or principal data from a New York school district, board of cooperative educational services, school or the State Education Department under a contract or other written agreement, limit internal access to education records to individuals determined to have legitimate educational interests (Educ. Law 2-d(5)(f)(1)).
- Do not use the education records for any purpose other than those explicitly authorized in your contract (Educ. Law 2-d(5)(f)(2)).
- Do not disclose personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless a statute or court order requires the disclosure and you give notice of it to the department, district board of education or institution that provided the information no later than the time of disclosure; your authorized representatives carrying out the contract are excepted (Educ. Law 2-d(5)(f)(3)).
- Maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of the personally identifiable student information in your custody, and use encryption technology to protect data while in motion or in your custody from unauthorized disclosure, using a technology or methodology the United States Department of Health and Human Services specifies in guidance under section 13402(h)(2) of Public Law 111-5 (Educ. Law 2-d(5)(f)(4) and (5)).
- Do not sell personally identifiable information maintained by an educational agency, including data provided to you as a third-party contractor or to your assignees, and do not use it for marketing purposes (Educ. Law 2-d(4)(f)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 2-d(5)(f) lists what a third party contractor must do with student data and names no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Education Law section 2-d defines a third party contractor as any person or entity, other than an educational agency, that receives student data or teacher or principal data from an educational agency under a contract or other written agreement to provide services to the agency. Section 2-d(5)(f) requires such a contractor to limit internal access to education records to individuals with legitimate educational interests and to use the records only for purposes its contract explicitly authorizes.
It also bars the contractor from disclosing personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless a statute or court order requires the disclosure and notice is given. The contractor must maintain reasonable administrative, technical and physical safeguards for personally identifiable student information in its custody and use encryption technology to protect the data in motion or in its custody.
Section 2-d(4)(f) provides that personally identifiable information maintained by educational agencies, including data provided to third-party contractors and their assignees, shall not be sold or used for marketing purposes.
Section 2-d(7)(b) makes each violation of the section by a third party contractor or its assignee punishable by a civil penalty of up to $1,000, a second violation involving the same data by up to $5,000, and any subsequent violation by up to $10,000, subject to the exception for the penalty in section 2-d(6)(d); each violation counts separately, and the total penalty may not exceed the maximum penalty under General Business Law section 899-aa(6)(a).
Section 2-d(7)(c) states that nothing in the section creates a private right of action against the department or an educational agency. On a complaint or other information indicating an improper disclosure, section 2-d(7)(a) authorizes the chief privacy officer to investigate, visit, examine and inspect the contractor's facilities and records and to obtain documentation from, or require the testimony of, any party.
Part 121 of the Commissioner's regulations, the regulation under Education Law section 2-d, became effective on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .