Schools in NYS have a new way to protect student data privacy |
On Board Online • July 1, 2024
By Louise DeCandia
When I became chief privacy officer for the State Education Department (SED) more than two years ago, many educators asked if the state could come up with an easier way for school districts to ensure that software vendors are protecting the privacy of students in compliance with state and federal laws.
Such a service is now available. In November 2023, SED purchased a statewide membership in a national education consortium called Access for Learning (A4L), which offers a National Data Protection Agreement that New York's schools have begun using. With assistance from The Education Cooperative Student Data Privacy Alliance (TEC SDPA), New York's schools can now use data protection agreements that have already been negotiated with software vendors to ensure compliance with privacy laws.
One such law is New York State Education Law Section 2-d, which ensures that student data cannot be shared for commercial or marketing purposes. Also relevant is the federal Family Educational Rights Privacy Act, commonly referred to as FERPA, which sets rules regarding the disclosure of "personally identifiable information" in educational records.
In the coming months, the 12 Regional Information Centers headquartered at BOCES throughout the state will be helping school districts upload their current data protection agreements onto the A4L dashboard to create a standardized data protection agreement structure for New York's schools.
The dashboard will make it easy for teachers, data protection officers and other school officials to determine which software vendors have entered into data protection agreements with New York schools. Just visit the New York Student Privacy Alliance page of the Access for Learning website at bit.ly/3XyrFwr and click on "Search by Vendor Member's Resources" or search by school district to see which products have an agreement.
If a teacher, data protection officer or other school official is looking for a specific product and does not see the vendor listed, they can contact their Regional Information Center to see if the vendor is willing to negotiate a data protection agreement. It is also easy for district officials to piggyback on pre-negotiated agreements with various vendors.
Currently, 73 school districts and BOCES are participating. Any school district that wants to participate but is currently not registered should contact its Regional Information Center and ask to be registered. Eventually, every school district should be participating because all schools are using education technology that collects data on students.
Typically, educational technology vendors collect all types of student data including the names of the students, their date of birth and their home address, as well as: phone numbers; attendance; test scores; grades; health issues; race; ethnicity; participation in free or reduced price meals; and even parent custody arrangements.
Unfortunately, some popular third party vendors do not abide by laws designed to protect privacy. Indeed, the business model of many vendors is to exchange free or low-cost services for user data. School districts and BOCES should not use such products of third party vendors. If student data is involved, schools should only use products that have data protection agreements.
Your teachers may ask: Why can't we take advantage of software products that we feel best meet the needs of our students? The answer is that lawmakers have decided that this pedagogical interest is outweighed by the risk of protecting student data. If schools work with their Regional Information Centers to use the tools provided by A4L, compliance with privacy laws should be much easier.
For more information, visit the student data privacy consortium page of the Access for Learning consortium at privacy.a4l.org . Also, my office is available to answer questions at privacy@nysed.gov .
Louise DeCandia is chief privacy officer at the State Education Department.