Data Privacy and Security

Ed Law 2-d and Part 121

WHAT IS ED LAW 2-D?
A law enacted in 2014 that focuses on the protection and handling of Personal Identifiable Information (PII).

WHAT IS STUDENT PII?
PII includes, but is not limited to:

The student’s name;
The name of the student’s parent or other family members;
The address of the student or student’s family;
A personal identifier, such as the student’s social security number, student number, or biometric record;
Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
Information requested by a person who the educational agency or institution reasonably
believes knows the identity of the student to whom the education record relates.

34 CFR §99.3. We also recommend protection of the additional element identified in the implementing regulations of the Individuals with Disabilities Education Act (IDEA), 20 U.S.C. §

1400 et seq., as PII, with regard to IDEA eligible students, that is: a list of personal
characteristics or other information that would make it possible to identify the child withreasonable certainty. 34 CFR § 300.32.

The confidentiality and privacy provisions do not apply to de-identified data (e.g., data regarding students that uses random identifiers), aggregated data (e.g., data reported at the school district level) or anonymized data that could not be used to identify a particular student.

DOES THIS PROTECT DATA OTHER THAN STUDENTS' DATA?
The protections in the statute also extend to teacher data or principal data, defined as PII from the records of an educational agency relating to the annual professional performance reviews of classroom teachers or principals that is confidential and not subject to release under the provisions of Education Law §§ 3012-c and 3012-d.

WHAT IS ED LAW 2-D PART 121?
The Board of Regents adopted Part 121 of the Regulations of the Commissioner of Education on January 13, 2020. These rules will implement Education Law Section 2-d and provide guidance to educational agencies and their third-party contractors on ways to strengthen data privacy and security to protect student data and annual professional performance review data.

The regulation went through multiple sets of revisions and three rounds of public comments and went into effect January 29, 2020. It will apply to both charter and traditional public schools.