Relates to the unauthorized release of personally identifiable information relating to students

Section 2 amends subdivision 3 of section 2-d of the education law by providing guidelines of public notice.

Sections 3 through 5 give restrictions and guidelines regarding the sale and use of personally identifiable information to be used commercially or for profit and requirements for the disclosure of that information.

Section 6 gives effective date.

Justification

New York has the opportunity to enhance and strengthen privacy protections for its students, which is especially critical as personally identifiable information will be digitized and shared electronically to audit and evaluate state and local education programs and to support the Statewide Longitudinal Data Systems. This makes data security and student safety of paramount concern and the State has an interest to ensure the disclosure of students' personally identifiable information meets the standards of the Fair Information Practice Principles, as outlined by the Federal Trade Commission: notice/awareness, choice/consent, access/participation, integrity/security, and enforcement/redress.

While FERPA protects student information privacy it does not go far enough, nor does it adequately address the privacy issues of the electronic age and the capacity of marketers and other commercial enterprises to capture, use, and re-sell student information. Even with privacy controls in place, it is also far too easy for individuals to get a hold of student information and use it for illegal purposes, including identity theft, child abduction in custody battles, and domestic violence.

Therefore, this proposed legislation will enhance the protection to New York students and their families by stipulating that a student's personally identifiable information by limiting disclosure to a third party for non-profit purposes with the consent from the parent or student, if the student is over age 18. Further, directory information, which can be disclosed under current law, may be restricted at the request of a parent or student over the age of 18. Lastly, this bill further enhances privacy by completely prohibiting the disclosure of directory information or personally identifiable information to a third party for profit-making purposes.

This legislation will give parents and students greater control over disclosure of personally identifiable information to third parties. It will protect students from their personal information being used by marketers who re-sell their information in secondary markets. The sophisticated electronic systems used to identify and breach the privacy of individuals should not have access to the personally identifiable information of vulnerable students. This added protection to New York students would protect them from opportunistic marketers and from identity theft.

Schools have been found to have varying degrees of conformance with the basic FERPA privacy requirements. Schools must become more proactive in providing parents with adequate notice of their rights to keep students' information private and handling the information as sensitive data. New York has the opportunity to become a national leader in helping schools to protect students from violations of their privacy by affording them added protections and the option not to disclose locator information. Recent proposed amendments to FERPA underscore this need, as students' personally identifiable information and data will be mined for the Statewide Longitudinal Data Systems, audit and evaluation of education programs, and research projects. Student data will be shared across government agency systems and with researchers, increasing the risk of data breaches and privacy violations. The proposed New York legislation would further restrict the release of personally identifiable information so that there will be fewer opportunities for data security to be compromised and do harm to an individual or group of students.

Students need and deserve this extra protection. In the digital age, the line between a computer-based school directory and the online world is rapidly disappearing. Computer security breaches are rampant, exposing supposedly private and proprietary information to online databases. New York should not wait for a major breach of student information with serious consequences before acting. Currently, the online collection of personal information from children under age 13 is protected under the Federal Trade Commission's Children's Online Privacy Protection Act (COPPA). COPPA outlines requirements of a website operator's privacy policy, when and how to seek verifiable consent from parents, privacy protections for children, and restrictions on marketing to children. Students deserve no less than the same kind of robust privacy Protections for their personal information maintained by their schools.

This legislation would create additional and needed privacy protections for students while not imposing any mandates or requiring additional spending by New York schools. The legislation will remind schools of their very serious obligation to protect student privacy, the risks of disclosing student information to commercial enterprises, and the challenges of collecting and disseminating personal data in the digital age. Schools are stewards of students' personally identifiable information and as such must adhere to the highest standards of practice in protecting privacy and confidentiality. This legislation will provide those standards and serve as a model for other states seeking to protect the privacy, safety, and security of its students.

Legislative history

New Bill

Fiscal implications

None.

Effective date

This act shall take effect July 1, 2017 and shall apply to school years beginning with the 2017-2018 academic year