Data Security Practices for Education

NYS Education Law Section 2-d Part 121.5 addresses new Data Security and Privacy Standards that took effect in July 2020.

These new standards  require educational institutions and their third-party contractors to take a variety of steps to protect both institutional data and student data from potential outside cyber-threats, such as stealing data, holding information systems hostage and causing system disruptions.

The Law §2-d requires that each educational agency shall publish a parent’s bill of rights for data privacy and security. The law also requires that with each contract an educational agency enters with a third-party contractor, that receives personally identifiable information (PII), must contain a signed bill of rights and supplemental information. In turn, each educational agency will have to publish, on its website, the signed parent’s bill of rights and supplemental information to the bill of rights for each software contract.

Data Protection Officer (DPO)
Name: Greg Thom
Email: [email protected]
Phone: 607-263-6100
Mailing Address 65 W. Main Street, Morris, NY 13808

RIC One District Data Privacy Inventory Tool (DPIT)
RIC One is comprised of 12 Regional Information Centers in New York State. These RICs work together with the State Education department to develop and provide services to school districts. The RIC One Data Privacy and Security (DPS) initiative supports district compliance with New York State's Common Core Reform Act, Education Law 2-d and Part 121 Regulations. One of the items created to help assist districts was the Data Privacy Inventory Tool or DPIT.

The Data Privacy Inventory Tool compiles a list of district software as required by Education Law §2-d Part 121 Regulations. It provides a means for sharing our parents' bill of rights, supplemental information and compliance with components of the NIST Cybersecurity Framework.
 
Key Categories of the Data Privacy Inventory Tool
Contract Source: How the software product is procured; either BOCES, District, or District - Free
Supporting Documentation: Document links or attachments to signed parent's bill or rights and supplemental information  

Note: Information posted in the data privacy inventory tool is continually updated.