Student Data Privacy Protections in New York State

New York’s Student Online Personal Information Protection Act or SOPIPA, otherwise known as AB 8556, is a student data privacy law that was passed in New York State in 2014. AB 8556 was the first student data protection law to be passed in the state of New York, and as such, establishes the guidelines that must be followed when collecting personal information from students enrolled in K-12 education programs and institutions around the state. Furthermore, the law also lays out the specific data elements concerning K-12 students that are legally protected from unauthorized access and use, as well as the permitted uses for such information.

How is the term educational agency defined under the law?

New York’s AB 8556 defines an educational agency to mean “any public school district, board of cooperative educational services, special act school district, public school kindergarten program, universal pre-kindergarten programs authorized pursuant to section thirty-six hundred two-e of this chapter, publicly funded pre-kindergarten programs, approved preschool special education programs pursuant to section forty-four hundred ten of this chapter, approved private school for the education of students with disabilities and a state-supported or state-operated school subject to the provisions of article eighty-five, eighty-seven or eighty-eight of this chapter.”

What are the duties of educational agencies under the law?

New York’s AB 8556 mandates that the New York Commissioner of Education develop standards and protocols that educational agencies and related institutions within the state are required to adhere to when managing the personal information of K-12 students within the state. With this being said, the duties that educational agencies have under the provisions of New York’s AB 8556 include but are not limited to:

• The New York Commissioner of Education is responsible for appointing a privacy officer that will oversee the protection of the personal information of all students enrolled in educational institutions throughout New York State. Moreover, this privacy officer is responsible for acting as an intermediary between the Commissioner and educational institutions around the state.
• The New York Commissioner of Education is responsible for formulating a procedure that will allow parents, teachers, superintendents, and other school officials to access the personal information of students.
• The New York Commissioner of Education is responsible for providing parents, guardians, and other relevant parties with an annual report on data security and privacy practices that have been implemented by educational agencies around the state, including any data breaches that occurred during the year, among other things.
• Educational agencies are responsible for developing and implementing security measures and procedures that will protect the personal information of their respective students from unauthorized access and use.
• Educational agencies are responsible for drafting, implementing, and publishing a parent’s bill of rights that outlines the rights that parents have under the law.

What data elements are protected under the law?

Some of the data elements that are protected from unauthorized access, use, and disclosure under New York’s AB 8556 include:

• Social security numbers.
• Student identification numbers.
• Student names.
• Email addresses.
• Home addresses.
• Telephone numbers.
• Dates and places of birth.
• Grade level.
• Special education data.
• Enrollment status.
• Major field of study.
• Dates of attendance.
• Photographs.
• Degrees, honors, and awards received.

What rights do parents have under the law?

Notably, New York’s AB 8556 provides parents and guardians of school-aged children with a number of rights as it pertains to the privacy of data protection of their children. Some of these rights include:

• Parents have the right to refuse the sale, rental, or transfer of the personal data of their children.
• Parents have the right to both inspect and review the contents of their children’s educational records.
• Parents have the right to right to file a complaint with the New York Commissioner of Education concerning a variety of issues, such as instances where a student’s information is disclosed as a result of a data breach, among other occurrences.
• Parents have the right to know how the personal data of their children will be stored, how this information will be used, and who will have access to such information.

As the first major student data privacy law to be enacted in New York State, the provisions of AB 8556 mandate that the New York Commissioner of Education, as well as individual educational agencies around the state, take a number of measures to ensure that the personal information of the students they serve is protected at all times. What’s more, through the numerous rights that are extended to parents under the law, citizens of New York State that enroll their children in public schools have the peace of mind that they will have the means to file a complaint and seek justice should the privacy of their children be infringed upon for any reason.