8-BPS Data Sharing and Confidentiality Agreement.pdf

DATA SHARING AND CONFIDENTIALITY AGREEMENT

Between

The Buffalo City School District

AND

[Vendor / Contractor Name] with

Bill of Rights for Data Privacy and Security &

Model Notification of Rights under FERPA for Elementary and Secondary Schools into by and between [Contractor Name] ) and Buffalo City School District.

WHEREAS, Buffalo City School District and Vendor/Contractor are Vendor

Vendor may receive student data and/or teacher or principal APPR protected under New York Education Law Section 2-d and Part 121 of the Regulations of the

- the District for purposes of providing certain educational products or services to the District; and/or

WHEREAS, the Vendor/Contractor for purposes of providing certain products or services to the District for an educational purpose, including but not limited to: educational partnership, data management or storage services, conducting studies for or on behalf of the District, or audit or evaluation of publicly funded programs and thus, may receive student, teacher, APPR and/or protected under New York Education Law § 2d and other state and federal laws, and regulations including but not limited to, FERPA, HIPAA, N.Y. Pub. Off. Law § 96 and IDEA; and

WHEREAS, this contract does not relieve the Contractor from responsibilities placed upon it by Federal or State laws, rules or regulations, even if not specifically listed in this contract;

and

WHEREAS, the Parties desire to fulfill their respective obligations under New York Education Law Section 2-d.

NOW THEREFORE, in consideration of the mutual promises and covenants contained in any existing Contract(s) between the parties, as well as this Agreement, the parties hereto mutually agree as follows:

1. Duration of Agreement

a. This agreement will commence on [xx/xx/xxxx] and will end on [xx/xx/xxxx]. Any termination of this agreement must be delivered in writing and does not release the vendor from any obligations, duties, or responsibilities that the Vendor/Contractor assumed under this contract or as a matter of law, including but not limited to any obligations, duties and responsibilities of third parties that the vendor/contractor has retained. Vendor understands and acknowledges that the termination of this agreement by Vendor shall terminate any existing Vendor Contracts for any services agreement that are affiliated with such data or Vendors ability to provide services in this regard.

2. Confidentiality

a. Vendor/Contractor, its employees, and/or agents (which shall include any third-party subcontractors) agree that all information obtained in connection with the services provided for in the Agreement and as described Protected Data above is deemed confidential information.

b. Vendor/Contractor, its employees, and/or agents (which shall include any third-party subcontractors) further agrees to maintain the confidentiality of the Protected Data it receives in accordance with Federal and NY State laws, rules and regulations and that any information obtained will not be revealed to any persons, firms or organizations.

3. Data Protections and Internal Controls

a. Vendor/Contractor acknowledges that it may receive and/or come into contact with personally identifiable information, as defined by New York Education Law Section 2-d, from records maintained by City of Buffalo School District that

Education Records

b. Vendor/Contractor understands and agrees to have in place sufficient protections and internal controls to ensure that information is safeguarded in accordance with applicable laws and regulations, and understands and agrees that it is responsible for complying with New York State data security and privacy standards for all personally identifiable information from Education Records, and it shall:

i. Limit internal access to Education Records to those individuals that are determined to have legitimate educational interests; and

ii. Not use the Education Records for any other purpose than those explicitly authorized in the Contract and/or Agreement; and

iii. Maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of Education Records in its custody; and

iv. Except for authorized representatives of the Vendor/Contractor to the extent of carrying out the contract, not disclose any Education Record to any other party:

1. Without the prior written consent of the parent or eligible student;

or

2. Unless required by statute or Court Order and the Vendor/Contract provides notice of disclosure to the District, unless legally prohibited, no later than the timeframe disclosed.

v. To use encryption technology to protect Protected Data while in motion or in its custody, using a technology or methodology specified by the secretary of the United States Department of Health and Human Services in guidance issued under Section 13402(H)(2) of Public Law 111-5.

c. Vendor/Contractor agrees and acknowledges that it has received and reviewed a Agreement and will provide a signed copy of same to the District upon execution of this Agreement.

d. Vendor/Contractor agrees that no employee, agents (which shall include any third-party subcontractors) or assignees shall have access to any District student data or teacher or Principal data until they have received Vendor/Contractor-provided training on the Federal and NY State Laws governing confidentiality of such data.

e. In the event the Vendor/Contractor requires to share such information with a Subcontractor or otherwise shares Protected Data with any other entity, Vendor/Contractor acknowledges and agrees that before any such data is shared with a Subcontractor or another entity, such party must agree in writing to be bound by the confidentiality and data protection provisions set forth in this Agreement and Vendor/Contract must have District approval of same.

i. Upon termination of the agreement between the Vendor/Contractor and a Subcontractor or other entity, Vendor/Contractor acknowledges and agrees that it is responsible for ensuring that all Protected Data shared by the BPS must be returned to the BPS or otherwise d

4. Data Security and Privacy Plan

a. Vendor/Contractor agrees to have a Data Security and Privacy Plan in place to protect the confidentiality, privacy and security of the Protected Data it receives from the District.

b. Vendor/Contractor understands and agrees that it is responsible for submitting a Data Security and Privacy Plan to the District prior to the start of the term of the Agreement, and it shall:

i. Outline how all state, federal and local data security and privacy contract requirements will be implemented over the life of the contract consistent with the security and privacy, as adopted.

ii. Outline specific administrative, operational and technical safeguards and practices in place to protect Protected Data that it receives from the District under the Contract.

iii. Outline the training requirement established by the Vendor/Contractor for all employees who will receive Protected Data and/or Educational Records.

c. Failure to execute this Agreement and provide a Data and Security Privacy Plan upon District request for compliance with New York State Education Law section 2-d may result in terminating any existing vendor/contractor services provided or existing Vendor Agreements involving access to Protected Data and/or Educational Records.

5. Notice of Breach and Unauthorized Release

a. In the event of a breach of this Agreement and unauthorized release of Protected Data and/or Educational Records the Vendor/Contractor shall:

i. Immediately after Vendor has discovered or been informed of the breach or unauthorized release, shall notify the District in the most expedient way possible and without unreasonable delay of the breach and unauthorized release of Protected Data/Educational Records.

ii. Notice shall be made to designated Data Protection Officer, currently:

Laura M. Samulski-Peters, Assistant Superintendent/Data Protection Officer Office of Shared Accountability Buffalo Public Schools 425 South Park Avenue, Buffalo, NY 14204 Lsamulski-peters@buffaloschools.org

iii. Advise the District as to the nature of the breach and steps Vendor has taken to minimize said breach.

b. In the case of required notification to a parent or eligible student as a result of a breach, the Vendor shall promptly reimburse the District for the full costs of such notification.

c. Vendor/Contractor will cooperate with the District and provide as much information as possible directly to the District about the incident, including but not limited to:

i. The description of the incident;

ii. The date of the incident;

iii. The date Vendor/Contractor discovered or was informed of the incident;

iv. A description of the types of Protected Data involved;

v. An estimate of the number of records affected;

vi. The schools within the District that are affected;

vii. What the Vendor has done or plans to do to investigate the incident, stop the breach and mitigate any further unauthorized access or release of Protected Data; and

viii. The contact information for Vendor representatives who can assist affected individuals that may have additional questions.

d. The Vendor/Contractor shall indemnify and hold the District harmless from any claims arising from its breach and unauthorized release of Protected Data/Educational Records.

e. Vendor/Contractor acknowledges that upon initial notification from Vendor, the District, as the educational agency with which Vendor contracts, has an obligation under Section 2-d to in turn notify the Chief Privacy Officer in the New York State

Vendor agrees not to provide this notification to the CPO directly unless the District requests that it do so or otherwise required by law. In the event the CPO contacts Vendor directly or requests more information from Vendor regarding the incident after having been initially informed of the incident by the District, Vendor will promptly inform the District of the same.

f. Vendor/Contractor acknowledges and understands that they may be subject to certain penalties, including, but not limited to, a monetary fine, mandatory training regarding Federal and New York State law governing confidentiality of Protected

Data or Educational Records, from an education agency for a fixed period up to five (5) years.

6. Vendor/Contractor Information. Vendor/Contractor understands that as part of the District's obligations under New York Education Law Section 2-d, Vendor/Contractor is responsible for providing the District with certain Vendor/Contractor information.

The following is the necessary Vendor/Contractor information, as provided by the Vendor:

a. Vendor/Contractor Contact information

i. Company Name: _________________________________________

ii. Contact Person or Representative Name: ______________________

iii. Address: ________________________________________________

iv. Phone #: ________________________________________________

v. Email: __________________________________________________

b. Description of Data

i. Specify whether this Agreement involves disclosure of Student Data, APPR

Data or both:

ii. Please provide the exclusive purposes for which the data will be used:

c. Data Access

i. Describe how you believe you would obtain access to the data in exercising the educational service [including the District Department involved]:

ii. List individuals or groups of individuals who will require access to the data to serve your educational purposes for the District. List the frequency that the data will be exchanged:

iii. Subcontractors. Will this contract require subcontractors? Identify any subcontractors or other persons/entities with whom the Vendor/Contractor need to share this Protected Data/Educational Records in the performance of this agreement and describe how the Vendor/Contractor will ensure that such persons/entities will abide by the data protection and security requirements of New York State Education Law 2d:

d. Data Security

i. Explain how you will ensure that your employees, agents or assignees/ subcontractors, will abide by data protection and security requirements:

ii. Describe the your de-identification practices for Protected Data:

iii. Explain where the Protected Data will be stored (described in such a manner as to protect data security), and the security protections taken to ensure such data will be protected, including whether such data will be encrypted:

e. Retention Policy. Describe the process by which you will ensure that Protected

Data will be returned or destroyed upon expiration of the Agreement:

f. Challenge. Explain the process by which a parent, student, or eligible teacher may challenge the accuracy of the student/teacher data that is collected:

g. Breach. Describe the your cybersecurity policies and response plan in the event of a breach and their remediation process:

7. Choice of law: If any disputes shall arise under this agreement the choice of law shall be New

York State and Venue shall be Erie County.

8. Termination or Expiration of Contract and/or Agreement

a. Upon termination of the Agreement, Vendor/Contractor shall return or destroy all confidential information/Protected Data/Educational Records obtained in connection with the services provided to the District. Destruction of the confidential information/Protected Data/Educational Records shall be accomplished utilizing an approved method of confidential destruction, including, shredding, burning or certified/witnessed destruction of physical materials and verified erasure of magnetic media using approved methods of electronic file destruction. The parties further agree that the terms and conditions set forth herein shall survive the expiration and/or termination of the Agreement.

b. If requested by the District, Vendor/Contractor will assist the District in exporting all Protected Data previously received back to the District for its own use, prior to deletion, in such formats as may be requested by the District.

c. In the event the Contract is assigned to a successor Vendor (to the extent authorized by the Contract), the Vendor will cooperate with the District as necessary to transition Protected Data to the successor Vendor prior to deletion.

d. Vendor/Contractor, any of its subcontractors or other authorized persons or entities to whom Vendor/Contractor has disclosed Protected Data to, shall not retain any Protected Data, copies, summaries or extracts of the Protected Data, or any de-identified Protected Data, on any storage medium whatsoever. Upon request, Vendor/Contractor, any of its subcontractors or other authorized persons or entities to whom Vendor/Contractor has disclosed Protected Data to, will provide the District with a certification from an appropriate officer that these requirements have been satisfied in full.

IN WITNESS WHEREOF, the parties hereto have executed this Agreement as of the day and year first written above.

Vendor Signature Buffalo City School District Signature

Date Date

EXHIBIT A

FOR DATA PRIVACY AND SECURITY

To satisfy their responsibilities regarding the provision of education to students in pre-kindergarten through grade twelve, (as defined below) in the State of New York collect and maintain certain personally identifiable information from the education records of their students. As part of the Common Core Implementation Reform Act, Education Law §2-d requires that each educational agency in the State of New York must develop a of Rights must be published on the website of each educational agency, and must be included below) where the third-party contractor receives student data, or certain protected teacher/principal data related to Annual Professional Performance Reviews that is designated as confidential pursuant to Education Law §3012-c legal guardians or persons in parental relation to a student, but generally not the parents of a student who is age eighteen or over) of the legal requirements regarding privacy, security and use of student data. In addition to the federal Family Educational Rights and Privacy Act (FERPA), Education Law §2-d provides important new protections for student data, and new remedies for Breaches of the responsibility to maintain the security and confidentiality of such data.

A.

Privacy Act (FERPA) rela student records?

The rights of parents under FERPA are summarized in the Model Notification of Rights prepared by the United States Department of Education for use by schools in providing annual notification of rights to parents. It can be accessed at https://studentprivacy.ed.gov/resources/ferpa-model-notification-rights-elementary-secondary-schools, and a copy is attached to Complete student records are maintained by schools and school districts, and not at the New York State Education Department (NYSED). Further, NYSED would need to establish and implement access to records before processing a

Rev. 7-29-14 request for records to the school or school district. Therefore, requests to access student records will be most efficiently managed at the school or school district level.

rights under FERPA include:

1. The right to inspect and review the student's education records within 45 days after the day the school or school district receives a request for access.

2.

or eligible student believes are inaccurate, misleading, or otherwise in violation of the Complete student records are maintained by schools and school districts and not at NYSED, which is the secondary repository of data, and NYSED make amendments to school or school district records. Schools and school districts are in the best position to make correc records.

3. The right to provide written consent before the school discloses personally identifiable information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without consent (including but not limited to disclosure under specified conditions to: (i) school officials within the school or school district with legitimate educational interests; (ii) officials of another school for purposes of enrollment or transfer; (iii) third party contractors providing services to, or performing functions for an educational agency; (iv) authorized representatives of the U. S. Comptroller General, the U. S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as NYSED; (iv) (v) organizations conducting studies for or on behalf of educational agencies) and (vi) the public where the school or school district has designated certain student data as d below). The attached FERPA Model Notification of Rights more fully describes the exceptions to the consent requirement under FERPA).

4.

from student records, the parent has a right to refuse to let the school or school district designate any all of such information as directory information. Directory address, telephone number, email address, photograph, date and place of birth, major field of study, grade level, enrollment status, dates of attendance, participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors and awards received and the most recent educational agency or institution attended. Where disclosure without consent is otherwise authorized under FERPA, however, a refusal to permit disclosure of directory information does not prevent disclosure pursuant to such separate authorization.

5. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the School to comply with the requirements of FERPA.

B. What are rights under the Personal Privacy Protection Law (PPPL), Article

6- A of the Public Officers Law relating to records held by State agencies?

The PPPL (Public Officers Law §§91-99) applies to all records of State agencies and is not specific to student records or to parents. It does not apply to school districts or other local educational agencies. It imposes duties on State agencies to have procedures in place to of a name, number, symbol, mark or oth Like FERPA, the PPPL confers a right on the data subject (student or the parent) to access to State agency records relating to them and requires State agencies to have procedures for correction or amendment of records.

A more detailed description of the PPPL is available from the Committee on Open Government of the New York Department of State. Guidance on what you should know about the PPPL can be accessed at https://opengovernment.ny.gov/what-you-should-know-nys-personal-privacy-protection-law-pppl . The address is Committee on Open Government, Department of State, One Commerce Plaza, 99 Washington Avenue, suite 650, Albany, NY 12231, their email address is coog@dos.ny.gov, and their telephone number is (518) 474-2518.

C. Rights Under Education Law §2-d relating to Unauthorized Release of Personally Identifiable Information

1. What are included in the requirements of Education Law §2-d?

The New York State Education Department Each public-school district;

Each Board of Cooperative Educational Services or BOCES; and All schools that are:

o a public elementary or secondary school;

o a universal pre-kindergarten program authorized pursuant to Education

Law §3602-e;

o an approved provider of preschool special education services;

o any other publicly funded pre-kindergarten program;

o a school serving children in a special act school district as defined in Education

Law 4001; or o certain schools for the education of students with disabilities - an approved private school, a state-supported school subject to the provisions of Education Law Article 85, or a state-operated school subject to Education Law Article 87 or 88.

2. What kind of student data is subject to the confidentiality and security requirements of Education Law §2-d?

The law applies to personally identifiable information contained in student records of an educational agency listed above.

or seeking to enroll in an educational agency, and the term identifiable

Under FERPA, personally identifiable information or PII includes, but is not limited to:

(a) The name;

(b) The name of the or other family members;

(c) The address of the student

(d) A personal identifier, such as the social security number, student number, or biometric record;

(e) Other indirect identifiers, such as the date of birth, place of birth, and Maiden Name1;

(f) Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

(g) Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

3. What kind of student data is not subject to the confidentiality and security requirements of Education Law §2-d?

The confidentiality and privacy provisions of Education Law §2-d and FERPA extend only to PII, and not to student data that is not personally identifiable. Therefore, de-identified data (e.g., data regarding students that uses random identifiers), aggregated data (e.g., data reported at the school district level) or anonymized data that could not be used to identify a particular student is not considered to be PII and is not within the purview of Education Law §2-d or within the scope of Bill of Rights.

4. What are my rights under Education Law § 2-d as a parent regarding my

PII?

Education Law §2-d ensures that, in addition to all of the protections and rights of parents under the federal FERPA law, certain rights will also be provided under the Education Law. These rights include, but are not limited to, the following elements:

1 Pease note that NYSED does not collect certain information defined in FERPA, numbers, biometric records, maiden name (unless used as the legal name).

(A) A student's PII cannot be sold or released by the educational agency for any commercial or marketing purposes.

o PII may be used for purposes of a contract that provides payment to a vendor for providing services to an educational agency as permitted by law.

o However, sale of PII to a third party solely for commercial purposes or receipt of payment by an educational agency, or disclosure of PII that is not related to a service being provided to the educational agency, is strictly prohibited.

(B) Parents have the right to inspect and review the complete contents of their child's education record including any student data stored or maintained by an educational agency.

o This right of inspection is consistent with the requirements of FERPA. In addition to the right of inspection of the educational record, Education Law §2-d provides a specific right for parents to inspect or receive copies of any data in the record.

o NYSED will develop policies for annual notification by educational agencies to parents regarding the right to request student data. Such policies will specify a reasonable time for the educational agency to comply with such requests.

o The policies will also require security measures when providing student data to parents, to ensure that only authorized individuals receive such data.

A parent may be asked for information or verifications reasonably necessary to authorized to receive such information pursuant to law.

(C) State and federal laws protect the confidentiality of PII, and safeguards associated with industry standards and best practices, including, but not limited to, encryption, firewalls, and password protection, must be in place when data is stored or transferred.

Education Law §2-d also specifically provides certain limitations on the collection of data by educational agencies, including, but not limited to:

(A) A mandate that, except as otherwise specifically authorized by law, NYSED shall only collect PII relating to an educational purpose;

(B) NYSED may only require districts to submit PII, including data on disability status and student suspensions, where such release is required by law or otherwise authorized under FERPA and/or the New York State Personal Privacy Law; and

(C) Except as required by law or in the case of educational enrollment data, school districts shall not report to NYSED student data regarding juvenile delinquency records, criminal records, medical and health records or student biometric information.

(D) Parents may access the NYSED Student Data Elements List, a complete list of all student data elements collected by NYSED, at http://www.p12.nysed.gov/irs/sirs/documentation/NYSEDstudentData.xlsx, or may obtain a copy of this list by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234; and

(E) Parents have the right to file complaints with an educational agency about possible Breaches of student data by that educational third-party contractors or their employees, officers, or assignees, or with NYSED.

Complaints to NYSED should be directed in writing to the Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany NY 12234, email to CPO@mail.nysed.gov. The complaint process is under development and will be established through regulations to be proposed by Chief Privacy Officer, who has not yet been appointed.

o Specifically, the Commissioner of Education, after consultation with the Chief Privacy Officer, will promulgate regulations establishing procedures for the submission of complaints from parents, classroom teachers or building principals, or other staff of an educational agency, making allegations of improper disclosure of student data and/or teacher or principal APPR data by a third-party contractor or its officers, employees or assignees.

o When appointed, the Chief Privacy Officer of NYSED will also provide a procedure within NYSED whereby parents, students, teachers, superintendents, school board members, principals, and other persons or entities may request information pertaining to student data or teacher or principal APPR data in a timely and efficient manner.

5. Must additional elements be included in the Bill of Rights?

Yes. For purposes of further ensuring confidentiality and security of student data, as an with a third-party contractor shall include the following supplemental information:

(A) the exclusive purposes for which the student data, or teacher or principal data, will be used;

(B) how the third-party contractor will ensure that the subcontractors, persons or entities that the third-party contractor will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements;

(C) when the agreement with the third-party contractor expires and what happens to the student data or teacher or principal data upon expiration of the agreement;

(D) if and how a parent, student, eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected; and

(E) where the student data or teacher or principal data will be stored (described in such a manner as to protect data security), and the security protections taken to ensure such data will be protected, including whether such data will be encrypted.

a. In addition, the Chief Privacy Officer, with input from parents and other education and expert stakeholders, is required to develop additional elements of the Bill of Rights to be prescribed in Regulations of the Commissioner.

6. What protections are required to be in place if an educational agency contracts with a third-party contractor to provide services, and the contract requires the disclosure of PII to the third-party contractor?

Education Law §2-receives student data or teacher or principal data from an educational agency pursuant to a contract or other written agreement for purposes of providing services to such educational agency. The term party also includes an educational partnership organization that receives student and/or teacher or principal APPR data from a school district to carry out its responsibilities pursuant to Education Law §211-e, and a not-for-profit corporation or other non-profit organization, which are not themselves covered by the definition of

Services of a third-party contractor covered under Education Law §2-d include, but not limited to, data management or storage services, conducting studies for or on behalf of the educational agency, or audit or evaluation of publicly funded programs.

When an educational agency enters into a contract with a third-party contractor, under which the third-party contractor will receive student data, the contract or agreement must include a data security and privacy plan that outlines how all state, federal, and local data security and privacy contract requirements will be implemented over the life of the contract, consistent with the educational agency's policy on data security and privacy. However, the and privacy must be prescribed in Regulations of the Commissioner that have not yet been well as a requirement that any officers or employees of the third-party contractor and its assignees who have access to student data or teacher or principal data have received or will receive training on the federal and state law governing confidentiality of such data prior to receiving access.

Each third-party contractor that enters into a contract or other written agreement with an educational agency under which the third-party contractor will receive student data or teacher or principal data shall:

o limit internal access to education records to those individuals that are determined to have legitimate educational interests o not use the education records for any other purposes than those explicitly authorized in its contract;

o except for authorized representatives of the third party contractor to the extent they are carrying out the contract, not disclose any PII to any other party

(i) without the prior written consent of the parent or eligible student; or (ii) unless required by statute or court order and the party provides a notice of the disclosure to NYSED, district board of education, or institution that provided the information no later than the time the information is disclosed, unless providing notice of the disclosure is expressly prohibited by the statute or court order;

o maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of PII in its custody; and o use encryption technology to protect data while in motion or in its custody from unauthorized disclosure.

7. What steps can and must be taken in the event of a Breach of confidentiality or security?

Upon receipt of a complaint or other information indicating that a third-party contractor may have Chief Privacy Officer is authorized to investigate, visit, examine and inspect the third-party contractor's facilities and records and obtain documentation from, or require the testimony of, any party relating to the alleged improper disclosure of student data or teacher or principal APPR data.

Where there is a Breach and unauthorized release of PII by a by a third-party contractor or its assignees (e.g., a subcontractor):

(i) the third-party contractor must notify the educational agency of the Breach in the most expedient way possible and without unreasonable delay;

(ii) the educational agency must notify the parent in the most expedient way possible and without unreasonable delay; and (iii) the third party contractor may be subject to certain penalties including, but not limited to, a monetary fine; mandatory training regarding federal and state law governing the confidentiality of student data, or teacher or principal APPR data; and preclusion from accessing any student data, or teacher or principal APPR data, from an educational agency for a fixed period up to five years.

8. Data Security and Privacy Standards

Privacy Officer will be required to develop, with input from experts, standards for educational agency data security and privacy policies.

The Commissioner will then promulgate regulations implementing these data security and privacy standards.

9. No Private Right of Action

Please note that Education Law §2-d explicitly states that it does not create a private right of action against NYSED or any other educational agency, such as a school, school district or

BOCES.

This Vendor/Contractor certifie Rights and has reviewed same, and further agrees share with whomever within their organization or subcontractors which may have exposure to student data in implementing this agreement

Authorized Vendor Signature

Date

EXHIBIT B

Model Notification of Rights under FERPA for Elementary and Secondary Schools

The Family Educational Rights and Privacy Act (FERPA) affords parents and students who are 18 years of age or older ("eligible students") certain rights with respect to the student's education records. These rights are:

1. The right to inspect and review the student's education records within 45 days after the day receives a request for access.

Parents or eligible students should submit to the school principal [or appropriate school official] a written request that identifies the records they wish to inspect.

The school official will make arrangements for access and notify the parent or eligible student of the time and place where the records may be inspected.

2. education records that the parent or eligible student believes are inaccurate, misleading, or otherwise in violation of the privacy rights under FERPA.

Parents or eligible students who wish to ask the [School] to amend a record should write the school principal [or appropriate school official], clearly identify the part of the record they want changed, and specify why it should be changed. If the school decides not to amend the record as requested by the parent or eligible student, the school will notify the parent or eligible student of the decision and of their right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the parent or eligible student when notified of the right to a hearing.

3. The right to provide written consent before the school discloses personally identifiable information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without consent.

One exception, which permits disclosure without consent, is disclosure to school officials with legitimate educational interests. A school official is a person employed by the school as an administrator, supervisor, instructor, or support staff member (including health or medical staff and law enforcement unit personnel) or a person serving on the school board. A school official also may include a volunteer or contractor outside of the school who performs an institutional service of function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, medical consultant, or therapist; a parent or student volunteering to serve on an official committee, such as a disciplinary or grievance committee; or a parent, student, or other volunteer assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

[Optional] Upon request, the school discloses education records without consent to officials of another school district in which a student seeks or intends to enroll, or is transfer. [NOTE: FERPA requires a school district to make a reasonable attempt to notify the parent or student of the records request unless it states in its annual notification that it intends to forward records on request.]

4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the [School] to comply with the requirements of FERPA. The name and address of the Office that administers FERPA are:

Family Policy Compliance Office U.S. Department of Education 400 Maryland Avenue, SW Washington, DC 20202

[NOTE: In addition, a school may want to include its directory information public notice, as required by §99.37 of the regulations, with its annual notification of rights under

FERPA.]

[Optional] See the list below of the disclosures that elementary and secondary schools may make without consent.

parent or eligible student, if the disclosure meets certain conditions found in §99.31 of the FERPA regulations. Except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student, §99.32 of the FERPA regulations requires the school to record the disclosure. Parents and eligible students have a right to inspect and review the record of disclosures. A school may disclose PII from the education records of a student without obtaining prior written consent of the parents or the eligible student

To other school officials, including teachers, within the educational agency or institution whom the school has determined to have legitimate educational interests. This includes contractors, consultants, volunteers, or other parties to whom the school has outsourced institutional services or functions, provided that the conditions listed in §99.31(a)(1)(i)(B)(1) - (a)(1)(i)(B)(2) are met.

(§99.31(a)(1))

To officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already or transfer, subject to the requirements of §99.34. (§99.31(a)(2))

To authorized representatives of the U. S. Comptroller General, the U. S.

Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as the State educational agency in the parent or

Disclosures under this provision may be made, subject to the requirements of §99.35, in connection with an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf. (§§99.31(a)(3) and 99.35)

In connection with financial aid for which the student has applied or which the student has received, if the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid. (§99.31(a)(4))

To State and local officials or authorities to whom information is specifically allowed to be reported or disclosed by a State statute that concerns the juvenile justice system the student whose records were released, subject to §99.38. (§99.31(a)(5))

To organizations conducting studies for, or on behalf of, the school, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction. (§99.31(a)(6))

To accrediting organizations to carry out their accrediting functions. (§99.31(a)(7))

To parents of an eligible student if the student is a dependent for IRS tax purposes. (§99.31(a)(8))

To comply with a judicial order or lawfully issued subpoena. (§99.31(a)(9))

To appropriate officials in connection with a health or safety emergency, subject to §99.36. (§99.31(a)(10)

§99.37. (§99.31(a)(11))