Parents Bill of Rights for Data Privacy and Security

Parents Bill of Rights for Data Privacy and Security

To satisfy their responsibilities regarding the provision of education to students in pre-kindergarten through grade twelve, “educational agencies” (as defined below) in the State of New York collect and maintain certain personally identifiable information from the educational records of their students. As part of the Common Core Implementation Reform Act, Education Law §2-d requires that each educational agency in the State of New York must develop a Parents’ Bill of Rights for Data Privacy and Security (Parents’ Bill of Rights). The Parents’ Bill of Rights must be published on the website of each educational agency and must be included with every contact the educational agency enters into with a “third party contractor” (as defined below) where the third-party contractor receives student data, or certain protected teacher/principal data related to Annual Professional Performance Reviews that is designated as confidential pursuant to Education Law §3012-c (“APPR data”).

The purpose of the Parents’ Bill of Rights is to inform parents (which also include legal guardians or persons in parental relation to a student, but generally not the parents of a student who is age eighteen or older) of the legal requirements regarding privacy, security and use of student data. In addition to the federal Family Educational Rights and Privacy Act (FERPA), Education Law §2-d provides important protections for student data, and new remedies for breaches of the responsibility to maintain the security of confidentiality of such data.

Parents’ rights under FERPA include:

  1. Students’ personally identifiable information cannot be sold or released for any commercial purposes.
  2. Parents have the right to inspect and review their student’s educational records within 45 days after the school receives a request for access.
  3. Student’s personally identifiable information must be kept confidential and secure when stored or transferred for necessary purposes.
  4. Parents shall be informed of all student data elements collected by the State. A complete list if all student data elements collected by NYSED is available at http://www.nysed.gov/data-privacy-security/student-data-inventory and by writing to: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234.
  5. Parents have the right to fille complaints about possible breaches of confidential student data by contacting Family Policy Compliance Officer, US Department of Education, 400 Maryland Avenue, Washington, DC 20202-852. Complaints may also be submitted to NYSED at http://nysed.gov/data-privacy-security/report-improper-disclosure or by writing to Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234.

Furthermore, whenever Abilities First enters into any contract with a third party that would have access to student personally identifiable information, we require the contractor to execute a Business Associate Agreement that binds the contractor to:

  1. Maintaining strict security and confidentiality of student data.
  2. Returning or eliminating student data when the contract expires.
  3. Allowing parents, eligible students, teachers, or principals to review and challenge the accuracy of student data.

This Parents’ Bill of Rights will be provided to all third-party contractors along with the Business Associate Agreement.