A08474 Summary:

BILL NOA08474B
 
SAME ASNo same as
 
SPONSORRosenthal (MS)
 
COSPNSRNolan
 
MLTSPNSR
 
Add S3212-b, Ed L
 
Requires notification of parents when student directory personally identifiable information is released to third parties; provides an opportunity to opt out.
Go to top    

A08474 Actions:

BILL NOA08474B
 
06/17/2011referred to education
01/04/2012referred to education
01/13/2012amend and recommit to education
01/13/2012print number 8474a
06/06/2012reported referred to rules
06/12/2012amend and recommit to rules 8474b
Go to top

A08474 Memo:

NEW YORK STATE ASSEMBLY
MEMORANDUM IN SUPPORT OF LEGISLATION
submitted in accordance with Assembly Rule III, Sec 1(f)
 
BILL NUMBER: A8474B
 
SPONSOR: Rosenthal (MS)
  TITLE OF BILL: An act to amend the education law, in relation to the release of personally identifiable student information by school districts   PURPOSE OR GENERAL IDEA OF BILL: To enhance privacy protections to students' personally identifiable student information contained in student education records maintained by schools and school districts and place additional restrictions on the release of personally identifiable student information.   SUMMARY OF SPECIFIC PROVISIONS: The Education Law is amended by adding a new section 3212-b to describe the lawful and unlawful dissemination of disclosable directory information and personally identifiable student information. This new section defines, under this act, student; school; disclosable directory information (DDT); and personally identifiable student information (PISI), Subsection 2 stipulates the legal dissemination of disclosable directory information and the provisions for the parents or student in attendance from opting-out of the dissemination of such information, and the prohi- bition of the dissemination of personally identifiable student informa- tion, unless the school receives the affirmative consent to do so from the parent or student in attendance. Disclosable Directory Information (DDT), The dissemination of a student's educational record within the school district is not restricted, and will comport with misting laws and regulations within said school district A school district may disseminate students' direc- tory information to the parent or student in attendance, and any educa- tional agency, organization, or institution; and a school district may disseminate students' directory information to a school club, newspaper, yearbook, honor roll, and the like, unless the parent or student in attendance prohibits the school district from doing so. Personally Identifiable Student Information (PISI). A school district may only distribute this information with the affirmative consent of the parent or student in attendance. If a parent or student grants the affirmative consent, the school may disseminate P151 to: another parent or student in attendance at the school; to non-profit that seeks the information for a specific purpose deemed to be beneficial for the student, and that has not violated the disclosure procedures stipulated in this section. If the third party violates the wishes of the custodial parent or student over the age of 18, it is prohibited from receiving this information for a period of five years. Furthermore, even with the affirmative consent of the parent or student in attendance, the school is prohibited from disseminating students' PISI to a third party for profit-making purposes, such as for marketing products or services, and selling the information for commercial purposes. Subsection 3 outlines the procedures for school districts notification of parents or students of their rights under this bill. To achieve active parental consent, within the first week of each new school year, the school district must issue a public notice, include in the student handbook, and send home with, the student, information stipulating the disclosure procedures for the DDI and PISI. The disclosure information shall consist of the definition of disclosable directory information and personally identifiable student information as defined in this act; the procedures for obtaining affirmative consent for prohibiting the school district from disseminating the student's DDI to a third party for non- profit purposes; the procedures for obtaining affirmative " consent for authorizing, the school district to disseminate the student's PISI to a third party for non-profit purposes. If the school district does not receive a response from the parent or student 30 days of the dissemination of the disclosure information notice, the school district will operate under the premise that: (i) The parent or student did not opt-out, thus allowing the school district to disseminate the DDT to a third party for non-profit purposes; and (ii) the parent or student did not opt-in, thus prohibiting the school district from disseminating the PIST to a third party for non-profit purposes Subsection 4 states that the new law shall not limit an employee of the board of education, state, court, of federal government from public school records purely for administrative purposes. Subsection 5 provides for exemptions with regard to military recruitment, in order to comply with federal law. Section 2 of the bill sets the effective date.   JUSTIFICATION: New York has the opportunity to enhance and strengthen privacy protections for its students, which is especially critical as personally identifiable information will be digitized and shared elec- tronically to audit and evaluate state and local education programs and to support the Statewide Longitudinal Data Systems. This makes data security end student safety of paramount concern and the State has an interest to ensure the disclosure of students' personally identifiable information meets the standards of the Pair Information Practice Princi- ples, as outlined by the Federal Trade Commission: notice/awareness, choice/consent, access/participation, integrity/security, and enforcement/redress. While FERPA protects student information privacy it does not go far Enough, nor does it adequately address the privacy issues of the elec- tronic age and the capacity of marketers and other commercial enter- prises to capture,, use, and re-sell student information. Even with privacy controls in place, it is also far too easy for individuals to get a hold of student information and use it for illegal purposes, including identity theft, child abduction in custody battles, and domes- tic violence. Therefore, this proposed legislation will enhance the protection to New York students and their families by stipulating that a student's personally identifiable information will only be disclosed to a third party for non-profit purposes with the consent from the parent or student, if the student is over age 18. Further, directory information, which can be disclosed under current law, may be restricted at the request, of a parent or student over the age of 18. Lastly, this bill further enhances privacy by completely prohibiting the disclosure of directory information or personally identifiable information to a third party for profit-making purposes. This legislation will give parents and students greater control over disclosure of personally identifiable information to third parties. It will protect students from their personal information being used by marketers who re-sell their information in secondary markets. The sophisticated electronic systems used to identify and breach the privacy of individuals should not have access to the personally identifiable information of vulnerable students. This added protection to New York students would protect them from opportunistic marketers and from iden- tity theft. Schools have been found to have varying degrees of conformance with the basic FERPA privacy requirements. Schools must become more proactive in providing parents with adequate notice of their rights to keep students' information private and handling the information as sensitive data. New York has the opportunity to become a national leader in helping schools to protect students from violations of their privacy by affording them added protections and the option not to disclose locator information. Recent proposed amendments to FERPA underscore -this need, as students' personally identifiable information and data will be mined for the Statewide Longitudinal Data Systems, audit and evaluation of education programs, and research projects. Student data will be shared across government agency systems and with researchers, increasing the risk of data breaches and privacy violations. The proposed New York legislation would further restrict the release of personally identifiable informa- tion so that there will be fewer opportunities for data security to be compromised and do harm to an individual or group of students. Students need and deserve this extra protection. in the digital ace, the line between a computer-based school directory and t he online world is rapidly disappearing. Computer security breaches are rampant, exposing supposedly private and proprietary information to online databases. New York should not wait for a major breach of student information with serious consequences before acting. Currently, the online collection of personal information from children under age 13 is protected under the Federal Trade Commission's Children's Online Privacy Protection Act (COPPA). COPPA outlines requirements of a website operator's privacy policy, when and how to seek verifiable consent from parents, privacy protections for children, and restrictions on marketing to children. Students deserve no less than the same kind of robust privacy protections for their personal information maintained by their schools. This legislation would create additional and needed privacy protections for students while not imposing any mandates or requiring additional spending by New York schools. The legislation will remind schools of their very serious obligation to protect student privacy, the risks of disclosing student information to commercial enterprises, and the chal- lenges of collecting and disseminating personal data in the digital age. Schools are stewards of students' personally identifiable information and as such must adhere to the highest standards of practice in protect- ing privacy and confidentiality. This legislation will provide those standards and serve as a .model for other states seeking to protect the privacy; safety, and security of its students.   PRIOR LEGISLATIVE HISTORY: S.7414-A/A.10795-A of 2009-2010   FISCAL IMPLICATIONS: None   EFFECTIVE DATE: Shall take effect July 1, 2013.
Go to top

A08474 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                         8474--B
 
                               2011-2012 Regular Sessions
 
                   IN ASSEMBLY
 
                                      June 17, 2011
                                       ___________
 
        Introduced by M. of A. ROSENTHAL, NOLAN -- read once and referred to the
          Committee on Education -- recommitted to the Committee on Education in
          accordance  with Assembly Rule 3, sec. 2 -- committee discharged, bill
          amended, ordered reprinted as amended and recommitted to said  commit-
          tee  --  reported  and  referred  to  the  Committee on Rules -- Rules

          Committee discharged, bill amended, ordered reprinted as  amended  and
          recommitted to the Committee on Rules
 
        AN  ACT  to  amend  the  education  law,  in  relation to the release of
          personally identifiable student information by school districts
 
          The People of the State of New York, represented in Senate and  Assem-
        bly, do enact as follows:
 
     1    Section 1. The education law is amended by adding a new section 3212-b
     2  to read as follows:
     3    §  3212-b.  Release  of  personally identifiable information by school
     4  districts.  1. For the purposes of  this  section  the  following  terms
     5  shall have the following meanings:
     6    (a) "Student" shall mean and include any person with respect to whom a
     7  school  maintains  education records or personally identifiable informa-

     8  tion, but does not include a person who has not been  in  attendance  at
     9  such school.
    10    (b)  The  term  "school"  means  any public school; in any city, union
    11  free, common or central school district and  any  non-public  school  of
    12  elementary or secondary education.
    13    (c)  The term "eligible student" means a student who has reached eigh-
    14  teen years of age.
    15    (d) Disclosable directory information (DDI) hereafter referred  to  in
    16  this  section  as  "directory  information",  means  with  respect  to a
    17  student, the student's name; photograph;  age;  grade  level;  dates  of
    18  attendance;   participation  in  officially  recognized  activities  and
    19  sports; weight and height of  members  of  athletic  teams;  honors  and

    20  awards received; and the most recent school attended.
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD07381-14-2

        A. 8474--B                          2
 
     1    (e) "Personally identifiable student information (PISI)" shall include
     2  disclosable  directory information, and a student's or parent's address,
     3  telephone number, and E-mail address.
     4    2.  (a)  A  school  may disclose directory information about a student
     5  only:
     6    (i) if the disclosure does not  include  any  information  other  than
     7  directory information as defined in this section;

     8    (ii)  after  giving  the  parent  of  the student in attendance or the
     9  eligible student in attendance at the school notice and  an  opportunity
    10  to  opt-out  of  the  disclosure in accordance with subdivision three of
    11  this section; and
    12    (iii) if the disclosure is to a  school  newspaper,  local  newspaper,
    13  school club or organization, school yearbook, honor roll or other recog-
    14  nition  list,  graduation  program,  sports  related  publication  which
    15  provides specific information about particular students for the purposes
    16  of a specific sports activity or function, or parent and teacher  organ-
    17  ization.
    18    (b)  A school may disclose personally identifiable student information

    19  only with the affirmative consent  of  the  parent  of  the  student  in
    20  attendance  or the eligible student in attendance in accordance with the
    21  procedure provided in subdivision three of this section if:
    22    (i) the disclosure is to the parent of any student  in  attendance  or
    23  any eligible student in attendance at the school; or
    24    (ii)  the  disclosure  is to a non-profit organization that: (A) seeks
    25  the information for a specific purpose determined by the  school  to  be
    26  beneficial to the student; (B) states in writing that it has not used or
    27  disclosed personally identifiable student information from any school in
    28  a  manner inconsistent with the terms of disclosure within the past five

    29  years; and (C) agrees in writing to use the information  only  for  that
    30  purpose  and  to  return or destroy the information when the purpose has
    31  been fulfilled or within one year after receipt, whichever comes  first;
    32  and
    33    (iii)  the school has no reason to believe that the recipient has used
    34  or disclosed personally identifiable student information from any school
    35  in a manner inconsistent with the terms of  the  disclosure  within  the
    36  past five years.
    37    (c)  Unless  otherwise allowed by law, a school may not, even with the
    38  affirmative consent of the parent of the student in  attendance  or  the
    39  eligible student in attendance, disclose personally identifiable student

    40  information  for  a  commercial,  for-profit  activity including but not
    41  limited to use for:
    42    (i) marketing products or services;
    43    (ii) selling personally identifiable student information  for  use  in
    44  marketing products or services;
    45    (iii) creating or correcting an individual or household profile;
    46    (iv) compilation of a student list;
    47    (v) sale of the information for any commercial purpose; or
    48    (vi)  any  other  purpose  considered  by the school as likely to be a
    49  commercial, for-profit activity.
    50    (d) In making an allowable disclosure under this subdivision, a school
    51  may only disclose the minimum amount of information necessary to  accom-
    52  plish the purpose of the disclosure.

    53    3.  Within the first week of each school year, each school shall issue
    54  a public notice, include in the student handbook,  and  send  home  with
    55  every  student,  information  stipulating  the disclosure procedures for
    56  directory information and personally identifiable student information.

        A. 8474--B                          3
 
     1    (a) The disclosure information shall  consist  of  the  definition  of
     2  directory information and personally identifiable student information as
     3  set forth in this section; and shall also include:
     4    (i) the procedure for prohibiting the school from disseminating direc-
     5  tory  information under paragraph (a) of subdivision two of this section

     6  and a description of any directory information that the school  proposes
     7  to disclose during the school year; and
     8    (ii)  the  procedure for authorizing the school to disclose personally
     9  identifiable student information under paragraph (b) of subdivision  two
    10  of this section and a description of any personally identifiable student
    11  information that the school proposes to disclose during the school year.
    12    (b)  (i)  If  the  school does not receive notice from the parent of a
    13  student in attendance or the  eligible  student  in  attendance  at  the
    14  school prohibiting the disclosure of directory information within thirty
    15  days  of the dissemination of the information required to be provided in

    16  paragraph (a) of this subdivision, the school may disseminate  directory
    17  information  relating to the student pursuant to paragraph (a) of subdi-
    18  vision two of this section.
    19    (ii) If the school does receive consent from the parent of  a  student
    20  in  attendance  or  the  eligible student in attendance at the school to
    21  disclose personally identifiable student information under paragraph (b)
    22  of  subdivision  two  of  this  section,  the  school  may   disseminate
    23  personally  identifiable  student  information  as  set  forth  in  this
    24  section.
    25    4. Nothing in this section  shall  limit  the  administrative  use  of
    26  public  school  records  by  a person acting exclusively in the person's

    27  capacity as an employee of a board of education or of the state  or  any
    28  of its political subdivisions, any court, or the federal government.
    29    5.  The  provisions  of this section shall not apply to the release of
    30  personally identifiable  student  information  to  the  department,  the
    31  United  States  military,  or  any  institution of higher education, any
    32  political subdivision or federal agency, or a school district or  school
    33  that demonstrates an appropriate need for the information.
    34    § 2. This act shall take effect July 1, 2013.
Go to top