New York State Education Department’s student data privacy law, Education Law § 2-d, and the Parent’s Bill of Rights for Data Privacy and Security

New York has an opportunity to be ahead of the curve to strengthen protection of students going forward. This would be best accomplished through comprehensive legislation and State Education rules and regulations that address specific areas of concern raised by privacy experts and parents. A model bill, “The Student Privacy Protect Act,” developed in collaboration with longtime privacy and information policy expert Robert Gellman, could serve best as a guide to drafting an exemplary bill. The proposed model bill recommends that a school may disclose directory information about a student as provided in 34 Code of Federal Regulations Section 99.37 only in the following cases:

(1) after giving the parent of the student or the eligible student at the school notice and opportunity to opt-out of the disclosure in accordance with Section 4;
(2) if the disclosure does not include any personally identifiable student information other than disclosable directory information; and
(3) if the disclosure is to a school newspaper; local newspaper; school club or organization; school yearbook; honor roll or other recognition list; graduation program; sports related publication which provides specific information about particular students for the purposes of a specific sports activity or function; or parent and teacher organization.

Under this model bill, “personally identifiable student information” means personally identifiable information and directory information. “Disclosable directory information” means the student’s name; photograph; age; major field of study; grade level; enrollment status (e.g., undergraduate or graduate, full time or part time); dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.

It is important to note that disclosable directory information does not include a student’s place and/or date of birth and contact information. In addition, and further following the recommendations of this model student privacy bill, the State could close the opt-out loophole in Education Law §2-d that endangers children by amending Section A to specify that student personally identifiable information cannot be sold or released by the educational agency for any commercial or marketing purposes, even when parents have not submitted a FERPA or student directory information opt out.

Sheila’s suggestions strike a balance between a more radical approach that would restrict disclosures even more, and the need and desire of schools and parents to be able to share information at times, such as being able to tell the local newspaper about how a school sports team did and who scored points, etc.  But do note her reference to endangering children. When parents do not opt-out of disclosures of “directory information,” their children may be at risk of being found by abusive, noncustodial parents. They may be at risk of being identified or found by government agencies that might deport or separate families.

We are living in increasingly dangerous times. Parents should not have to know to demand an opt-out form at the beginning of each school year.  In my opinion, opt-out should be the default for directory information, directory information should be seriously limited as to types of information (as Sheila also recommends) and limiting directory information and making opt-out the default should be accomplished by statewide legislation, if not by federal regulation.

You can read all of Sheila’s comments in the document embedded below: