New York State Data Privacy and Security

• Ed Law 2D  - Education Law § 2-d went into effect in April 2014.  The focus of the statute was to foster privacy and security of personally identifiable information (PII) of students and certain PII related to classroom teachers and principals.
• Part 121 Amendment to Ed Law 2D - Although the proposed regulations largely restate the requirements of Education Law § 2-d, there are new elements, including the adoption by the New York State Education Department of a data security and privacy standard, as was required by the statute.  The Department will adopt the National Institute for Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 (CSF or Framework)

Contact Us

If you have any questions or concerns regarding Data Privacy and Security, please contact Michael Foley, Director of Data and Technology and Data Protection Officer for the Phoenix Central School District 315-695-1549.

Notification of Specific Events

Notification

The District will notify the New York State Attorney General (AG), the New York State Department Consumer Protection Board (CPB) and the New York State Office of Cyber Security (OCS), as required by law. All affected individuals must be notified of the breach if their compromised data meets the classifications described in law. The District may delay notification of affected individuals if law enforcement determines that notification may impede a criminal investigation.

The required notice shall be directly provided to the affected persons by one of the following methods:

1. Written notice;
2. Electronic notice, provided that the person to whom notice is required has expressly consented to receiving the notice in electronic form; and a log of each such notification is kept by the District when notifying affected persons in electronic form. However, in no case shall the District require a person to consent to accepting such notice in electronic form as a condition of establishing any business relationship or engaging in any transaction;
3. Telephone notification, provided that a log of each such notification is kept by the District when notifying affected persons by phone; or
4. Substitute notice, if the District demonstrates to the State Attorney General that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds $500,000, or that the District does not have sufficient contact information. Substitute notice shall consist of all of the following:
   1. Email notice when the District has an email address for the subject persons;
   2. Conspicuous posting of the notice on the District's website page, if the District maintains one; and
   3. Notification to major statewide media.

Regardless of the method of which notice is provided, a notification must include:

1. Contact information for the District official handling the notification;
2. A description of the categories of information that were, or are reasonably believed to have been, acquired without authorization; and
3. Details on which elements of personal and private information were, or are reasonably believed to have been, so acquired.

The New York State Office of Cyber Security will be informed as to the timing, content and distribution of the notices and the approximate number of affected persons. The Attorney General and the Division of Consumer Protection should also be informed of these notices to affected persons. Refer to New York State Security Breach Reporting Form for contact information, addresses and notification guidelines.