Urgent! Take action to strengthen data privacy regulations in NYS. SED is still collecting very sensitive, personally identifiable data on our children.
As a result of the controversy over inBloom and related issues, the NY State legislature passed Education Law §2-d in 2014, with the goal of protecting the privacy and the security of student data that schools, districts and states as well as their contractors collect and disclose. After nearly five years, the NY State Education Department has finally issued proposed regulations to be used in enacting and enforcing this law. The deadline for commenting on these regulations is this Sunday, March 31.
The Parent Coalition for Student Privacy, along with NYSAPE and Class Size Matters, has sent detailed comments to NYSED on how these regulations should be improved, especially as they omit several important provisions of the law. We have also prepared an email you can send NYSED in support of our proposed changes by clicking here. You can of course alter this email in any way you like, or send your own comments to REGCOMMENTS@nysed.gov, but please remember the deadline is Sunday. Thank you!
As a result of the controversy over inBloom and related issues, the NY State legislature passed Education Law §2-d in 2014, with the goal of protecting the privacy and the security of student data that schools, districts and states as well as their contractors collect and disclose. After nearly five years, the NY State Education Department has finally issued proposed regulations to be used in enacting and enforcing this law. The deadline for commenting on these regulations is this Sunday, March 31.
The Parent Coalition for Student Privacy, along with NYSAPE and Class Size Matters, has sent detailed comments to NYSED on how these regulations should be improved, especially as they omit several important provisions of the law. We have also prepared an email you can send NYSED in support of our proposed changes by clicking here. You can of course alter this email in any way you like, or send your own comments to REGCOMMENTS@nysed.gov, but please remember the deadline is Sunday. Thank you!
PARENT COALITION FOR STUDENT PRIVACY, NYSAPE & CLASS SIZE MATTERS
NYS PRIVACY REGULATIONS – PUBLIC COMMENT
The issue of student privacy is very important to me and I concur with the detailed comments submitted by the Parent Coalition for Student Privacy, New York State Allies for Public Education and Class Size Matters on how to strengthen your proposed regulations for the Education Law §2-d, a law that was approved by the legislature in the spring of 2014. I urge you to incorporate their proposed changes in the final regulations, including but not limited to the following:
• In the Parent Bill of Rights, the following laws must be included: Protection of Pupil Rights Amendment (PPRA), National School Lunch Act (NSLA) and Children’s Online Privacy Protection Act (COPPA) .The regulations should also include the section in the state law that provides the Chief Privacy Officer with the authority to expand the Parent Bill of Rights in the future, as the threats to student privacy and cybersecurity are likely to grow.
• The personal information of former students and former teachers as well as current students and teachers should be explicitly covered, and the state should not be collecting any personally identifiable data on students regarding their country of birth or in-school or out-of-school suspensions, given the extreme sensitivity of this data. The regulations should also include the specific provisions in Education Law §2-d that bar districts from reporting to the state any data regarding (1) juvenile delinquency records;(2) criminal records;(3) medical and health records; and(4) student biometric information, except as required by law or required enrollment data.
• In order to collect personal student data, vendors must have written contracts with the education agencies and must be responsible for making sure that this data is available to parents upon request and responsible for correcting errors if challenged.
• The word “license” should be added to the section on the Parent Bill of Rights and in the section that prohibits districts and/or their contractors from selling personal student data, so that contractors are barred from selling or licensing student data for a fee. In addition, vendors and contractors should be explicitly barred from selling data in the case of a bankruptcy.
• Education agencies should be required to publish their data security and privacy policies on their websites and provide notice of these policies to parents, not just employees. They should be required to post all contracts with vendors who collect student data, which should specify which categories of personal student data they are collecting and how parents may request access to that data. Education agencies should also have to explain what the educational purpose is for allowing vendors access to this data.
• Data breach notification to parents and affected parties should be carried out by snail mail as well as email; not phone calls; and the regulations should incorporate all the powers and responsibilities of the Chief Privacy Officer as stated in Education Law §2-d; including the responsibility to issue an annual report on data breaches and improper data disclosures, as well as the results of any and all investigations into parental complaints.
• In the Parent Bill of Rights, the following laws must be included: Protection of Pupil Rights Amendment (PPRA), National School Lunch Act (NSLA) and Children’s Online Privacy Protection Act (COPPA) .The regulations should also include the section in the state law that provides the Chief Privacy Officer with the authority to expand the Parent Bill of Rights in the future, as the threats to student privacy and cybersecurity are likely to grow.
• The personal information of former students and former teachers as well as current students and teachers should be explicitly covered, and the state should not be collecting any personally identifiable data on students regarding their country of birth or in-school or out-of-school suspensions, given the extreme sensitivity of this data. The regulations should also include the specific provisions in Education Law §2-d that bar districts from reporting to the state any data regarding (1) juvenile delinquency records;(2) criminal records;(3) medical and health records; and(4) student biometric information, except as required by law or required enrollment data.
• In order to collect personal student data, vendors must have written contracts with the education agencies and must be responsible for making sure that this data is available to parents upon request and responsible for correcting errors if challenged.
• The word “license” should be added to the section on the Parent Bill of Rights and in the section that prohibits districts and/or their contractors from selling personal student data, so that contractors are barred from selling or licensing student data for a fee. In addition, vendors and contractors should be explicitly barred from selling data in the case of a bankruptcy.
• Education agencies should be required to publish their data security and privacy policies on their websites and provide notice of these policies to parents, not just employees. They should be required to post all contracts with vendors who collect student data, which should specify which categories of personal student data they are collecting and how parents may request access to that data. Education agencies should also have to explain what the educational purpose is for allowing vendors access to this data.
• Data breach notification to parents and affected parties should be carried out by snail mail as well as email; not phone calls; and the regulations should incorporate all the powers and responsibilities of the Chief Privacy Officer as stated in Education Law §2-d; including the responsibility to issue an annual report on data breaches and improper data disclosures, as well as the results of any and all investigations into parental complaints.