N.Y. Education Law § 2-c: Release of student information to certain entities

§ 2-c. Release of student information to certain entities. 1.

Definitions. As used in this section the following terms shall have the

following meanings:

a. "Student information" shall mean personally identifiable

information and biometric records as such terms are defined in section

99.3 of title 34 of the code of federal regulations implementing the

Family Education Rights and Privacy Act, as such federal law and

regulations are from time to time amended, or any other individual

student records and shall also include de-identifiable information which

means a collection of data or information that has been altered with the

goal of making the student or students associated with such data or

information permanently unknowable.

b. "Personally identifiable information" shall mean personally

identifiable information as defined in section 99.3 of title 34 of the

code of federal regulations implementing the Family Education Rights and

Privacy Act, section 1232-g of title 20 of the United States code, as

such federal law and regulations are from time to time amended.

c. "Shared learning infrastructure service provider" or "SLISP" shall

mean any entity that collects, stores, organizes, or aggregates student

information and contracts with or enters into an agreement with the

department for the purposes of providing student information to a data

dashboard operator for use in a data dashboard. Provided that the term

SLISP shall not include boards of cooperative educational services or

regional information centers operated by boards of cooperative

educational services or other public entities.

d. "Data dashboard" shall mean an electronic data system or hosted

software application or applications that is designed to utilize data

and information collected, stored, organized or aggregated by a SLISP

and that is designed to provide, through a contract between a New York

school district and a data dashboard operator, end users such as

educators, students and their families with access to customized student

information with the goal of supporting instruction and student

learning.

e. "Data dashboard operator" shall mean any third party contractor

owning or operating a data dashboard that contracts or otherwise enters

into an agreement to utilize data and information from a SLISP.

f. "Educational agency" shall mean any public school district, board

of cooperative educational services, special act school district, public

school kindergarten program, universal pre-kindergarten programs

authorized pursuant to section thirty-six hundred two-e of this chapter,

publicly funded pre-kindergarten programs, approved preschool special

education programs pursuant to section forty-four hundred ten of this

chapter, approved private school for the education of students with

disabilities and a state supported or state operated school subject to

the provisions of article eighty-five, eighty-seven or eighty-eight of

this chapter.

g. "Student" shall mean any person attending an educational agency

identified in paragraph f of this subdivision.

2. An educational agency may opt out of providing personally

identifiable information to a SLISP or data dashboard operator for the

purpose of creating data dashboards. An educational agency may at any

time request that any personally identifiable information associated

with such agency not be shared or provided to a SLISP or data dashboard

operator. Such request shall be made to the department and upon receipt

of such request, the department shall take all actions necessary to

prevent and prohibit the sharing or providing of such information to any

SLISP or data dashboard operator and that upon receipt of such request,

the department shall take actions to immediately ensure that any

personally identifiable information provided to any SLISP or data

dashboard operator is deleted from such SLISP or operator and destroyed

in a secure manner.

3. The commissioner and the department are hereby prohibited from

providing any student information to a SLISP and the commissioner and

department shall take actions to immediately ensure that any student

information provided to any SLISP shall be deleted from such SLISP and

destroyed in a secure manner.