Law / United States / 
New York
Education Law section 2-d, breach notice by a third party contractor to the educational agency
N.Y. Educ. Law § 2-d(6)(a), (c) and (d)
In force.
A breach notification rule binding private bodies.
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- If you are a third party contractor that receives student data or teacher or principal data under a contract or other written agreement with a New York educational agency, notify the educational agency of any breach of security resulting in an unauthorized release of that data by you or your assignees, in the most expedient way possible and without unreasonable delay (Educ. Law 2-d(6)(a)).
- When the educational agency must notify a parent, eligible student, teacher or principal because of an unauthorized release of data by you or your assignee, promptly reimburse the agency for the full cost of the notification (Educ. Law 2-d(6)(c)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 2-d(6) sets a notice to the educational agency and a reimbursement of notification cost and names no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 2-d(6)(a) requires each third party contractor that receives student data or teacher or principal data to notify the educational agency of any breach of security resulting in an unauthorized release of that data by the contractor or its assignees, in the most expedient way possible and without unreasonable delay.
Under section 2-d(6)(c), when notice to a parent, eligible student, teacher or principal is due to an unauthorized release by a third-party contractor or its assignee, the contractor must promptly reimburse the educational agency for the full cost of the notification.
Section 2-d(6)(d) makes each violation of the contractor's notice duty punishable by a civil penalty of the greater of five thousand dollars or up to ten dollars per student, teacher, and principal whose data was released, and the per-person amount may not exceed the maximum penalty under General Business Law section 899-aa.
If the chief privacy officer determines that a contractor released data to a person not authorized by law to receive it, section 2-d(6)(e) lets the officer, after notice and an opportunity to be heard, bar the contractor from accessing student data from the agency concerned for up to five years.
Where the contractor or assignee knowingly or recklessly allowed the release, section 2-d(6)(e) also lets the officer bar it from the student data of every educational agency in the state for up to five years and order that it not be deemed a responsible bidder on a contract with an educational agency involving such data for up to five years; the officer may require training at the contractor's expense before further access, and where the release was inadvertent and without intent, knowledge, recklessness or gross negligence, the commissioner may determine that no penalty be issued.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .