NYS Education Department – Data Privacy and Security
The Riverhead Central School District has implemented the requirements of Education Law Section 2-d and its implementing regulations, as well as to align the Riverhead Central School District’s data privacy and security practices with the National Institute for Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (Version 1.1). With regard to personnel and business practices, this procedure is intended to supplement current policy/procedures regarding PII.
The Riverhead Central School District, in recognition of the risk of identity theft and unwarranted invasion of privacy, affirms its commitment to safeguarding student personally identifiable information (PII) in educational records from unauthorized access or disclosure in accordance with State and Federal law. The Riverhead Central School District establishes the following parental bill of rights:
- Student PII will be collected and disclosed only as necessary to achieve educational purposes in accordance with State and Federal Law.
- The district and its schools, and third-party contractors and subcontractors, will not sell student PII or use or disclose it for any marketing or commercial purposes or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so.
- Parents have the right to inspect and review the complete contents of their child’s education record (for more information about how to exercise this right, see 5500-R).
- State and federal laws, such as NYS Education Law §2-d and the Family Educational Rights and Privacy Act, protect the confidentiality of students’ personally identifiable information. Safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls, and password protection, must be in place when data is stored or transferred.
- A complete list of all student data elements collected by the State Education Department is available for public review at http://nysed.gov/data-privacy-security/student-data-inventory or by writing to: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234.
- Parents have the right to have complaints about possible breaches and unauthorized disclosures of student data addressed. Complaints should be directed to (insert district contact information including title, phone number, email and mailing address here). Complaints can also be directed to the New York State Education Department online at http://nysed.gov.data-privacy-security, by mail to the Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234 or by email to privacy@mail.nysed.gov or by telephone at 518-474-0937.
- Parents have the right to be notified in accordance with applicable laws and regulations if a breach or unauthorized release of their student’s PII occurs.
- All district and school employees and officers with access to PII will receive annual training on applicable federal and state laws, regulations, district and school policies and safeguards which will be in alignment with industry standards and best practices to protect PII.
- In the event that the District engages a third party provider to deliver student educational services, the contractor or subcontractors will be obligated to adhere to State and Federal Laws to safeguard student PII. Parents can request information about third party contractors by contacting (insert district contact information including title, phone number, email and mailing address here) or can access the information on the district’s website (www.riverhead.net).
All software used in the District, both free and subscription-based, are vetted for compliance with New York State Education Law 2d, the Children’s Online Privacy Protection Act, and the Children’s Internet Protection Act. This is a “living” list that is updated regularly which shows the sites that have been deemed as approved for use in the District. A link to the Privacy Policy contains additional information specific to the company’s policies. In addition, where appropriate, we have included supplemental information that further explains the protection of student and staff data.
Teachers: To Request a new application please contact your content area director or building administrator.
Data Privacy and Security
The Riverhead Central School District is committed to protecting the privacy and security of each and every student’s data.
Education Law § 2-d requires each educational agency in the State of New York to develop a Parents’ Bill of Rights for Data Privacy and Security and publish it on its website.
The law also requires that with each contract an educational agency enters with a third-party contractor, that receives personally identifiable information (PII), must contain a signed bill of rights and supplemental information. In turn, each educational agency will have to publish, on its website, the signed parent’s bill of rights and supplemental information to the bill of rights for each software contract.
The purpose of the Parents’ Bill of Rights is to provide information to parents (which also include legal guardians or persons in parental relation to a student, but generally not the parents of a student who is age eighteen or over) and eligible students about certain legal requirements that protect personally identifiable information pursuant to state and federal laws.
Data Security Practices for Education
The New York State Education Department is committed to promoting sound information practices and policies that will strengthen data privacy and security at state educational agencies, empower parents with information, and advance efficient and effective school operations.
NYS Education Law Section 2-d Part 121.5 addresses new Data Security and Privacy Standards that took effect in July 2020.
These new standards require educational institutions and their third-party contractors to take a variety of steps to protect both institutional data and student data from potential outside cyber-threats, such as stealing data, holding information systems hostage and causing system disruptions.
Education Law Section 2-D Definitions
If you have any questions or concerns regarding data privacy and security, or suspect there has been a data breach, please contact Dr. Robert Baum, Data Protection Officer (DPO). In the event of a data breach, the public will be notified via our district’s communication platform.
Data Protection Officer (DPO)
Name: Laura L. Arcuri
Laura L. Arcuri
Phone: (631) 369- 6714
Mailing Address: 814 Harrison Ave., Riverhead NY 11901
Video Explaining Education Law Section 2-D
Resources and Information
Riverhead Central School District is providing the following information/resources for parents, teachers, and the community so that they can better understand what student data is, how student data is collected and used and the laws and practices that the district adheres to in order to protect student data and privacy.
Parent and Staff Information
- What do we mean by Student Data?
- NYSED Fact Sheet for Parents
- NYSED How to Report an Improper Disclosure
- Protecting Student Privacy 101
- Inventory of Data Elements Collected by NYSED
- Data Security Practices for Educators
- NYSED Parent Data Dashboard
New York State Data Privacy and Security
- NYSED October 28, 2020 Memo Regarding Data Security and Privacy
- NYSED Data Security and Privacy Policy
- Part 121 Amendment to Ed Law 2D- Although the proposed regulations largely restate the requirements of Education Law § 2-d, there are new elements, including the adoption by the New York State Education Department of a data security and privacy standard, as was required by the statute. The Department will adopt the National Institute for Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 (CSF or Framework).
Federal & State Laws That Impact Technology Use & Student Privacy