Establishes penalties for the unauthorized release of personally identifiable information from student records and certain records of classroom teachers and building principals

Summary of provisions

Section 1: Section 1 amends section 305 of the education law by adding a new subdivision 44. The bill first lays out the definitions as used within the act. Notable definitions include: "student data" which refers to the personally identifiable information ("PII") of a student; "teacher or principal data" which refers to the PII of teachers and principals in regards to their annual professional performance reviews; and "third party contractor" which refers to persons or entities who are allowed to access such PIT of students, teachers, or principals.

The bill thereafter creates the position of Chief Privacy Officer ("CPO") within the State Education Department ("SED"). The CPO shall be selected by the commissioner and shall be responsible for formulating the policies and procedures as they relate to student data or teacher or principal data The CPO shall be required by January 1, 2014, and each January first thereafter, to submit an annual report to the executive and legislative branches that will address issues and updates on student data and privacy in the State.

The bill requires the CPO to work with members of the yew York State Educational Conference Board and parents to establish a Parents Bill of Rights for Data Privacy and Security ("Parents Bill of Rights"). The Parents Bill of Rights shall be required to be signed and adhered to by any third party contractor that enters into an agreement with an educational agency, i.e., a district or BOCES, or the SED, where that third party contactor receives any PIT of students, teachers, or principals. The Parents Bill of Rights is to be completed within 120 days of this bill being enacted.

The bill would also permit districts to opt-out of having the data they are required to submit to SED due to federal and state requirements from being uploaded to SED's statewide education data portal ("EDP").

The bill requires that the CPO publish on SED's website a complete list of all data elements that are collected, why such data elements are collected, and the legal and/or regulatory authority the department has to collect such data elements.

The bill additionally requires that any time there is a breach of student data or teacher or principal data that the third party contractor notify the district, parent, teacher, and/or principal, as applicable, in the most expedient way possible and without unreasonable delay. If a third party contractor fails to notify in the most expedient way possible and without unreasonable delay, the third party contractor may be subject to a class E felony as well as a civil penalty up to $150,000.

SED is authorized to impose administrative penalties that are greater than the penalties that the federal Family Educational Rights and Privacy Act ("FERPA") provides. SED may prohibit a third party contractor from accessing student data or teacher or principal data from the district that is harmed or from any district within the state for a fixed period of up to five years. SED may also determine that the third Party contactor is not deemed a "responsible bidder" for purposes of submitting requests for proposals or that the third party contractor must provide additional training to its employees in the areas of data privacy and security. If it is determined that any release of data was no fault of the third party contractor, the department may make a finding that no administrative penalties should be imposed.

The bill would also require the commissioner to establish regulations whereby individuals may submit complaints of a possible breach of data to the CPO.

The bill would also require SED to promulgate regulations outlining best practices for districts to follow in regards to privacy and security. Each district would have 90 days from enactment of this legislation to ensure it has adopted the best practices guidelines.

Moreover, each third party contactor would be required to establish that it has privacy protections in place when it contracts to acquire student data or teacher or principal data in its official capacities. The third party contractor would also have to agree in writing to abide by the terms of the Patents Bill of Rights each time it receives student data or teacher or principal data.

Finally, the bill outlines civil penalties that may be imposed upon a third party contactor if they are in violation of this act.

Section 2: Section 2 creates new definitions in the penal law by amending subdivision 7 and creating new subdivisions 10, 11, and 12 to section 156.00 of the penal law.

Section 3: Section 3 creates a new class E felony in section 156.30 of the penal law when a person is guilty of unlawful duplication of computer material in the first degree with the intent to disseminate such material.

Section 4: Section 4 adds a new subdivision B to section 165.45 of the penal law.

Section 5: Section 5 sets forth an effective date that this act shall take effect 90 days after it shall become law, provided however, the

commissioner shall have 120 days from enactment to establish a Parents Bill of Rights.

Justification

For many years it has been prerogative of school districts and the State Education Department ("SED") to collect data on our students to better enhance the students' educational experience and to allow for the efficient operation of school districts. By collecting data on our students, teachers and administrators can better formulate lesson plans and better provide services that our students desperately need. The data that has been collected has also been very beneficial to parents who, in many instances, have the opportunity to quickly access their child's grades and attendance records.

Presently, every district in the state contracts with third party vendors to provide many of the services that benefit our children This is not a new phenomenon. In fact, using outside vendors to provide services to districts has been an established practice and protocol for many years. These services include transportation, food and lunch programs, and special education services, among many others. These types of services would be very costly and time consuming if individual districts had the burden of administering them exclusively. Vendors, therefore, are a necessary component of a child's education because most districts do not have the time, resources, or expertise to provide the services being provided under the contract. Simply put, if a district did not contract out for these services, our students would not be receiving the high quality education that we should expect for all of our students.

Consent, in certain instances, is not needed by parents or eligible students by third party contactors that collect personally identifiable information ("PIT") because of exceptions in the federal Family Educational Rights and Privacy Act ("FERPA") and its implementing regulations. These excepted circumstances are institutional services that are necessary for the functioning of a school district. As indicated above, without these institutional services provided by third party contractors, school districts would severely struggle to exist and children would be denied necessary services.

While FERPA contains many protections to prevent PII from being disclosed to inappropriate parties or being re-disclosed if given to a third party contactor, FERPA should be viewed as a floor. The only penalty available under FERPA is a five-year prohibition from accessing data from the respective school district that the third party contractor received the data from.

This bill would accomplish beneficial goals to enhance the protections of our students PII. It would create greater transparency of what data is being collected, who has access to it, and what happens to the data when the contracted for services are completed. It would create a Chief Privacy Officer ("CPO") to oversee student data and privacy at the department. In addition, it creates very strict civil and criminal penalties to act as deterrents from abuse. Importantly, this bill would not only protect the PII of our students, but it would also

protect the P11 of cur teachers and principals in their annual professional performance reviews ("APPR").

Another critical aspect of this bill is to allow districts to opt-out of having the student, teacher, and principal data they already send to the department based on state and federally required directives, from being unloaded to the as-yet-complete education data portal ("EDP"). Since 2010, the Regents Reform Agenda has ambitiously changed the educational landscape in New York through a transition to the common core standards, common core aligned assessments, and a teacher and principal evaluation system. While these are all important and noteworthy steps in ensuring every student in the state receives a high quality education, there has been considerable consternation on the part of parents, administrators, teachers, and students at the pace at which the Reform Agenda has been rolled out. Changes are continually being advanced to ensure those initiatives are implemented correctly, and notably, districts and their unions are right now going back to the table to fine tune their APPR plans. Therefore, districts, parents, teachers, and students simply cannot afford another onerous obligation on top of the significant changes they are currently undertaking.

There is no doubt that some districts would reap immediate benefits from the EDP, however, it should at the very least be optional for districts to take part in this mandated initiative while they continue to deal with the already complex and time consuming implemented aspects of the Reform Agenda. While participation in the EDP under this legislation would be optional, it is important to note that districts would, still-as has been current practice-be obligated to send the data they are currently required to collect to the Department.

It is fundamental that we protect our students, teachers, and principals P11 from being used inappropriately. It is also important that we allow districts to continue to use data responsibly in order to provide necessary services for our students by continuing to allow third parties to provide the services they have been providing for many years. This bill would strike an appropriate balance between protecting our students, teachers and Principals, and allowing districts to provide necessary services efficiently.

Legislative history

New bill

Fiscal implications

To be determined.

Effective date

This act shall take effect on the ninetieth day after it shall become law, provided however, the commissioner shall have 120 days from enact- ment to develop a parents bill of rights for student data and privacy.