A Message from the Chief Privacy Officer
Education Law Section 2-d was passed as part of the 2014 budget bill, meaning there is no bill jacket to review to help interpret some of the language that might be confusing. However, even if some confusion remains, it is unmistakable that transparency is one of the law’s pillars. This is evidenced by the law’s authorization of parents and eligible students to file privacy complaints with their local educational agency or my office, as well as the requirement to adopt and publicly post a Parents Bill of Rights which includes supplemental information about the third party contractors an educational agency is sharing PII with.
This school year, the Privacy Office has received several questions regarding the requirement to publicly post supplemental information. This issue was also discussed at the DPSS Conference last spring. Education Law Section 2-d (3)(c) and Section 121.3 of the Commissioner’s regulations require educational agencies to publish the Parents Bill of Rights on their website. This includes supplemental information for each contract where a third-party contractor receives student data. As discussed, this mandate is one of several transparency requirements in Education Law Section 2-d.
Section 121.3 [e] of the Commissioner’s regulations allow the supplemental information to be redacted to the extent necessary to safeguard the privacy and security of the educational agency’s data or technology infrastructure. It is the Privacy Office’s opinion that redaction is rarely necessary. There is no evidence supporting the theory that threat actors attack schools that publicly display the education technology tools they use. Additionally, many of the same educational agencies that complain about this requirement list the portals, student information and management systems and other tools the school uses on their website to assist parents and students.
If schools place their supplemental information on a portal or other non-public facing web page, all parents must have ready access to the information without having to ask for it and a notice about where to locate the information must be on the school’s webpage. A hidden link or login or a notice that the information will be furnished upon request is not acceptable.
Finally, this requirement is not unique to New York. Several other states including Colorado, Illinois and Connecticut require their schools to publicly post all the third-party vendors the school district is sharing student data with.
| 
