2310623375AppendixE.pdf

Group 23106 – Solicitation 23375 STEM/STEAM and Science Laboratory Equipment and Supplies

NYS Office of General Services Procurement Services Page 1 of 2

January 2020 Appendix E

APPENDIX E - DATA SECURITY AND PRIVACY MANDATES

New York State considers the protection of sensitive and confidential information and business systems to be of the utmost importance. The information collected and maintained by Authorized Users is protected by a myriad of Federal and State laws and regulations.

The following chart reflects several significant federal and state laws, rules and regulations, policies, standards and guidelines that vendors must be aware of. Links to further guidance are included. The list is not intended to be all-inclusive. Further, since laws, regulations, requirements and industry guidelines change, consulting definitive sources to assure a clear understanding of compliance requirements is critical. Many Authorized Users have additional program compliance requirements that must be considered in addressing compliance. Details should be outlined in the Request for Product Review (RFPR) prior to engagement of services.

Significant federal and state laws, regulations, policies, standards, and guidelines

• New York State Education Law §2-d

• Federal Educational Rights and Privacy Act (FERPA)

• The Protection of Pupil’s Rights Amendment (PPRA)

• The Children’s Online Privacy Protection Rule (COPPA)

1.1 New York State Education Law §2-d - Unauthorized Release of Personally Identifiable Information

Chapter 56 of the Laws of 2014 added §2-d to the Education Law effective April 2014. The focus of the law is the privacy and security of personally identifiable information (PII) of students, and certain annual professional performance review (APPR) data of teachers and principals. The law outlines certain requirements for educational agencies and their third-party contractors to ensure the security and privacy of such protected information.

New York State Education Law §2-d guidance: http://www.nysed.gov/data-privacy-security

Family Educational Rights and Privacy Act (FERPA)

Protects the privacy of student education records. “Education records” are “those records, files documents, and other materials which 1) contain information directly related to a student; and 2) are maintained by an educational institution. Examples: Grades, courses taken, schedule, test scores, advising records, educational services received, disciplinary actions, student identification number, Social Security number, student private email.

FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

FERPA requirements guidance:

- https://studentprivacy.ed.gov/ferpa

- Electronic Code of Federal Regulations, Title 34, Part 99

1.3 Protection of Pupil Rights Amendment (PPRA)

PPRA defines the rules states and school districts must follow when administering tools like surveys, analysis, and evaluations funded by the US Department of Education to students. It requires parental approval to administer many such tools and ensures that school districts have policies in place regarding how the data collected through these tools can be used.

PPRA requirements guidance:

https://www.govinfo.gov/content/pkg/USCODE-2010-title20/html/USCODE-2010-title20-chap31-subchapIII-part4-sec1232h.htm http://www.nysed.gov/data-privacy-security https://studentprivacy.ed.gov/ferpa https://www.govinfo.gov/content/pkg/USCODE-2010-title20/html/USCODE-2010-title20-chap31-subchapIII-part4-sec1232h.htm https://www.govinfo.gov/content/pkg/USCODE-2010-title20/html/USCODE-2010-title20-chap31-subchapIII-part4-sec1232h.htm

Group 23106 – Solicitation 23375 STEM/STEAM and Science Laboratory Equipment and Supplies

NYS Office of General Services Procurement Services Page 2 of 2

January 2020 Appendix E

1.4 Children’s Online Privacy Protection Rule (COPPA)

COPPA imposes certain requirements on operators of websites, games, mobile apps or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age.

COPPA requirements guidance:

https://www.ftc.gov/tips-advice/business-center/privacy-and-security/children%27s-privacy https://www.ftc.gov/tips-advice/business-center/privacy-and-security/children%27s-privacy