Requires notification of parents when student directory personally identifiable information is released to third parties; provides an opportunity to opt out.
NEW YORK STATE ASSEMBLY MEMORANDUM IN SUPPORT OF LEGISLATION submitted in accordance with Assembly Rule III, Sec 1(f)
BILL NUMBER: A8474B
SPONSOR: Rosenthal (MS) TITLE OF BILL: An act to amend the education law, in relation to the
release of personally identifiable student information by school
districts
PURPOSE OR GENERAL IDEA OF BILL: To enhance privacy protections to
students' personally identifiable student information contained in
student education records maintained by schools and school districts and
place additional restrictions on the release of personally identifiable
student information.
SUMMARY OF SPECIFIC PROVISIONS: The Education Law is amended by adding
a new section 3212-b to describe the lawful and unlawful dissemination
of disclosable directory information and personally identifiable student
information. This new section defines, under this act, student; school;
disclosable directory information (DDT); and personally identifiable
student information (PISI),
Subsection 2 stipulates the legal dissemination of disclosable directory
information and the provisions for the parents or student in attendance
from opting-out of the dissemination of such information, and the prohi-
bition of the dissemination of personally identifiable student informa-
tion, unless the school receives the affirmative consent to do so from
the parent or student in attendance.
Disclosable Directory Information (DDT), The dissemination of a
student's educational record within the school district is not
restricted, and will comport with misting laws and regulations within
said school district A school district may disseminate students' direc-
tory information to the parent or student in attendance, and any educa-
tional agency, organization, or institution; and a school district may
disseminate students' directory information to a school club, newspaper,
yearbook, honor roll, and the like, unless the parent or student in
attendance prohibits the school district from doing so.
Personally Identifiable Student Information (PISI). A school district
may only distribute this information with the affirmative consent of the
parent or student in attendance. If a parent or student grants the
affirmative consent, the school may disseminate P151 to: another parent
or student in attendance at the school; to non-profit that seeks the
information for a specific purpose deemed to be beneficial for the
student, and that has not violated the disclosure procedures stipulated
in this section. If the third party violates the wishes of the custodial
parent or student over the age of 18, it is prohibited from receiving
this information for a period of five years.
Furthermore, even with the affirmative consent of the parent or student
in attendance, the school is prohibited from disseminating students'
PISI to a third party for profit-making purposes, such as for marketing
products or services, and selling the information for commercial
purposes.
Subsection 3 outlines the procedures for school districts notification
of parents or students of their rights under this bill. To achieve
active parental consent, within the first week of each new school year,
the school district must issue a public notice, include in the student
handbook, and send home with, the student, information stipulating the
disclosure procedures for the DDI and PISI. The disclosure information
shall consist of the definition of disclosable directory information and
personally identifiable student information as defined in this act; the
procedures for obtaining affirmative consent for prohibiting the school
district from disseminating the student's DDI to a third party for non-
profit purposes; the procedures for obtaining affirmative " consent for
authorizing, the school district to disseminate the student's PISI to a
third party for non-profit purposes.
If the school district does not receive a response from the parent or
student 30 days of the dissemination of the disclosure information
notice, the school district will operate under the premise that: (i) The
parent or student did not opt-out, thus allowing the school district to
disseminate the DDT to a third party for non-profit purposes; and (ii)
the parent or student did not opt-in, thus prohibiting the school
district from disseminating the PIST to a third party for non-profit
purposes
Subsection 4 states that the new law shall not limit an employee of the
board of education, state, court, of federal government from public
school records purely for administrative purposes. Subsection 5 provides
for exemptions with regard to military recruitment, in order to comply
with federal law.
Section 2 of the bill sets the effective date.
JUSTIFICATION: New York has the opportunity to enhance and strengthen
privacy protections for its students, which is especially critical as
personally identifiable information will be digitized and shared elec-
tronically to audit and evaluate state and local education programs and
to support the Statewide Longitudinal Data Systems. This makes data
security end student safety of paramount concern and the State has an
interest to ensure the disclosure of students' personally identifiable
information meets the standards of the Pair Information Practice Princi-
ples, as outlined by the Federal Trade Commission: notice/awareness,
choice/consent, access/participation, integrity/security, and
enforcement/redress.
While FERPA protects student information privacy it does not go far
Enough, nor does it adequately address the privacy issues of the elec-
tronic age and the capacity of marketers and other commercial enter-
prises to capture,, use, and re-sell student information. Even with
privacy controls in place, it is also far too easy for individuals to
get a hold of student information and use it for illegal purposes,
including identity theft, child abduction in custody battles, and domes-
tic violence.
Therefore, this proposed legislation will enhance the protection to New
York students and their families by stipulating that a student's
personally identifiable information will only be disclosed to a third
party for non-profit purposes with the consent from the parent or
student, if the student is over age 18. Further, directory information,
which can be disclosed under current law, may be restricted at the
request, of a parent or student over the age of 18. Lastly, this bill
further enhances privacy by completely prohibiting the disclosure of
directory information or personally identifiable information to a third
party for profit-making purposes.
This legislation will give parents and students greater control over
disclosure of personally identifiable information to third parties. It
will protect students from their personal information being used by
marketers who re-sell their information in secondary markets. The
sophisticated electronic systems used to identify and breach the privacy
of individuals should not have access to the personally identifiable
information of vulnerable students. This added protection to New York
students would protect them from opportunistic marketers and from iden-
tity theft.
Schools have been found to have varying degrees of conformance with the
basic FERPA privacy requirements. Schools must become more proactive in
providing parents with adequate notice of their rights to keep students'
information private and handling the information as sensitive data. New
York has the opportunity to become a national leader in helping schools
to protect students from violations of their privacy by affording them
added protections and the option not to disclose locator information.
Recent proposed amendments to FERPA underscore -this need, as students'
personally identifiable information and data will be mined for the
Statewide Longitudinal Data Systems, audit and evaluation of education
programs, and research projects. Student data will be shared across
government agency systems and with researchers, increasing the risk of
data breaches and privacy violations. The proposed New York legislation
would further restrict the release of personally identifiable informa-
tion so that there will be fewer opportunities for data security to be
compromised and do harm to an individual or group of students. Students
need and deserve this extra protection. in the digital ace, the line
between a computer-based school directory and t he online world is
rapidly disappearing. Computer security breaches are rampant, exposing
supposedly private and proprietary information to online databases. New
York should not wait for a major breach of student information with
serious consequences before acting. Currently, the online collection of
personal information from children under age 13 is protected under the
Federal Trade Commission's Children's Online Privacy Protection Act
(COPPA). COPPA outlines requirements of a website operator's privacy
policy, when and how to seek verifiable consent from parents, privacy
protections for children, and restrictions on marketing to children.
Students deserve no less than the same kind of robust privacy
protections for their personal information maintained by their schools.
This legislation would create additional and needed privacy protections
for students while not imposing any mandates or requiring additional
spending by New York schools. The legislation will remind schools of
their very serious obligation to protect student privacy, the risks of
disclosing student information to commercial enterprises, and the chal-
lenges of collecting and disseminating personal data in the digital age.
Schools are stewards of students' personally identifiable information
and as such must adhere to the highest standards of practice in protect-
ing privacy and confidentiality. This legislation will provide those
standards and serve as a .model for other states seeking to protect the
privacy; safety, and security of its students.
PRIOR LEGISLATIVE HISTORY: S.7414-A/A.10795-A of 2009-2010
FISCAL IMPLICATIONS: None
EFFECTIVE DATE: Shall take effect July 1, 2013.
STATE OF NEW YORK
________________________________________________________________________
8474--B
2011-2012 Regular Sessions
IN ASSEMBLY
June 17, 2011
___________
Introduced by M. of A. ROSENTHAL, NOLAN -- read once and referred to the
Committee on Education -- recommitted to the Committee on Education in
accordance with Assembly Rule 3, sec. 2 -- committee discharged, bill
amended, ordered reprinted as amended and recommitted to said commit-
tee -- reported and referred to the Committee on Rules -- Rules
Committee discharged, bill amended, ordered reprinted as amended and
recommitted to the Committee on Rules
AN ACT to amend the education law, in relation to the release of
personally identifiable student information by school districts
The People of the State of New York, represented in Senate and Assem-bly, do enact as follows:
1 Section 1. The education law is amended by adding a new section 3212-b
2 to read as follows:
3 § 3212-b. Release of personally identifiable information by school
4 districts. 1. For the purposes of this section the following terms
5 shall have the following meanings:
6 (a) "Student" shall mean and include any person with respect to whom a
7 school maintains education records or personally identifiable informa-
8 tion, but does not include a person who has not been in attendance at
9 such school.
10 (b) The term "school" means any public school; in any city, union
11 free, common or central school district and any non-public school of
12 elementary or secondary education.
13 (c) The term "eligible student" means a student who has reached eigh-
14 teen years of age.
15 (d) Disclosable directory information (DDI) hereafter referred to in
16 this section as "directory information", means with respect to a
17 student, the student's name; photograph; age; grade level; dates of
18 attendance; participation in officially recognized activities and
19 sports; weight and height of members of athletic teams; honors and
20 awards received; and the most recent school attended.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[] is old law to be omitted.
LBD07381-14-2
A. 8474--B 2
1 (e) "Personally identifiable student information (PISI)" shall include
2 disclosable directory information, and a student's or parent's address,
3 telephone number, and E-mail address.
4 2. (a) A school may disclose directory information about a student
5 only:
6 (i) if the disclosure does not include any information other than
7 directory information as defined in this section;
8 (ii) after giving the parent of the student in attendance or the
9 eligible student in attendance at the school notice and an opportunity
10 to opt-out of the disclosure in accordance with subdivision three of
11 this section; and
12 (iii) if the disclosure is to a school newspaper, local newspaper,
13 school club or organization, school yearbook, honor roll or other recog-
14 nition list, graduation program, sports related publication which
15 provides specific information about particular students for the purposes
16 of a specific sports activity or function, or parent and teacher organ-
17 ization.
18 (b) A school may disclose personally identifiable student information
19 only with the affirmative consent of the parent of the student in
20 attendance or the eligible student in attendance in accordance with the
21 procedure provided in subdivision three of this section if:
22 (i) the disclosure is to the parent of any student in attendance or
23 any eligible student in attendance at the school; or
24 (ii) the disclosure is to a non-profit organization that: (A) seeks
25 the information for a specific purpose determined by the school to be
26 beneficial to the student; (B) states in writing that it has not used or
27 disclosed personally identifiable student information from any school in
28 a manner inconsistent with the terms of disclosure within the past five
29 years; and (C) agrees in writing to use the information only for that
30 purpose and to return or destroy the information when the purpose has
31 been fulfilled or within one year after receipt, whichever comes first;
32 and
33 (iii) the school has no reason to believe that the recipient has used
34 or disclosed personally identifiable student information from any school
35 in a manner inconsistent with the terms of the disclosure within the
36 past five years.
37 (c) Unless otherwise allowed by law, a school may not, even with the
38 affirmative consent of the parent of the student in attendance or the
39 eligible student in attendance, disclose personally identifiable student
40 information for a commercial, for-profit activity including but not
41 limited to use for:
42 (i) marketing products or services;
43 (ii) selling personally identifiable student information for use in
44 marketing products or services;
45 (iii) creating or correcting an individual or household profile;
46 (iv) compilation of a student list;
47 (v) sale of the information for any commercial purpose; or
48 (vi) any other purpose considered by the school as likely to be a
49 commercial, for-profit activity.
50 (d) In making an allowable disclosure under this subdivision, a school
51 may only disclose the minimum amount of information necessary to accom-
52 plish the purpose of the disclosure.
53 3. Within the first week of each school year, each school shall issue
54 a public notice, include in the student handbook, and send home with
55 every student, information stipulating the disclosure procedures for
56 directory information and personally identifiable student information.
A. 8474--B 3
1 (a) The disclosure information shall consist of the definition of
2 directory information and personally identifiable student information as
3 set forth in this section; and shall also include:
4 (i) the procedure for prohibiting the school from disseminating direc-
5 tory information under paragraph (a) of subdivision two of this section
6 and a description of any directory information that the school proposes
7 to disclose during the school year; and
8 (ii) the procedure for authorizing the school to disclose personally
9 identifiable student information under paragraph (b) of subdivision two
10 of this section and a description of any personally identifiable student
11 information that the school proposes to disclose during the school year.
12 (b) (i) If the school does not receive notice from the parent of a
13 student in attendance or the eligible student in attendance at the
14 school prohibiting the disclosure of directory information within thirty
15 days of the dissemination of the information required to be provided in
16 paragraph (a) of this subdivision, the school may disseminate directory
17 information relating to the student pursuant to paragraph (a) of subdi-
18 vision two of this section.
19 (ii) If the school does receive consent from the parent of a student
20 in attendance or the eligible student in attendance at the school to
21 disclose personally identifiable student information under paragraph (b)
22 of subdivision two of this section, the school may disseminate
23 personally identifiable student information as set forth in this
24 section.
25 4. Nothing in this section shall limit the administrative use of
26 public school records by a person acting exclusively in the person's
27 capacity as an employee of a board of education or of the state or any
28 of its political subdivisions, any court, or the federal government.
29 5. The provisions of this section shall not apply to the release of
30 personally identifiable student information to the department, the
31 United States military, or any institution of higher education, any
32 political subdivision or federal agency, or a school district or school
33 that demonstrates an appropriate need for the information.
34 § 2. This act shall take effect July 1, 2013.
