What is Ed Law 2-d?
In early 2020, The New York State Department of Education adopted a new law focused on the privacy and security of student and staff personally identifiable information (PII). The Educational Law Section 2-d, known amongst NY schools as Ed Law 2-d, provides “guidance to educational agencies and their third-party contractors on ways to strengthen data privacy and security to protect student data and annual professional performance review data.”
NY EdLaw 2-d Security Requirements
In order to strengthen data security and privacy, the New York State Education Department (NYSED), now requires the following of all educational agencies:
- Appoint a Data Protection Officer with appropriate knowledge, training, and experience to oversee data security and privacy.
- Develop and implement a Data Security and Privacy Policy.
- Conduct security training for educational agency employees.
- Publish a Parent’s Bill of Rights and include it in every contract with a third-party contractor that receives PII.
- Mandate that all third-party contractors submit a Data Security and Privacy
- Plan for each contract to demonstrate how they will protect PII.
- Adopt the NIST Cybersecurity Framework as the standard for data privacy and security and meet the requirements to ensure they are adequately protecting PII.
See the complete list of vendors the district works with, along with signed privacy and bill of rights agreements. This list will be periodically updated as needed.
Parents’ Bill of Rights for Data Privacy and Security
The Cohoes City School District is committed to ensuring student privacy in accordance with local, state and federal regulations and district policies. To this end and pursuant to U.S. Department of Education regulations, the district is providing the following Parents’ Bill of Rights for Data Privacy and Security:
- A student’s personally identifiable information cannot be sold or released for any commercial or marketing purposes.
- Parents have the right to inspect and review the complete contents of their child’s education record, including any student data maintained by the Cohoes City School District. This right of inspection of records is consistent with the federal Family Educational Rights and Privacy Act (FERPA). Under the more recently adopted regulations (Education Law §2-d), the rights of inspection are extended to include data, meaning parents have the right to inspect or receive copies of any data in their child’s educational record. The New York State Education Department (SED) will develop further policies and procedures related to these rights in the future.
- State and federal laws protect the confidentiality of personally identifiable information and safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls and password protection, must be in place when data is stored or transferred.
- A complete list of all student data elements collected by the state is available for public review. Parents may also obtain a copy of the list by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234.
- Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be directed to: Peggy O’Shea, Superintendent, poshea@cohoes.org, 518-237-0100.
- Complaints to SED should be directed to: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234; the e-mail address is cpo@mail.nysed.gov.
This bill of rights is subject to change based on regulations of the commissioner of education and the SED chief privacy officer, as well as emerging guidance documents from SED.