The New York State Education Department (“NYSED”) recently issued a memorandum indicating it will begin monitoring school districts’ websites in the fall 2023 for compliance with New York State Education Law § 2-D (“Section 2-D”) and the Family Educational Rights and Privacy Act (“FERPA”). Accordingly, school districts should ensure that their websites are compliant with these privacy laws prior to the start of the 2023-2024 school year. 

Overview of FERPA and Section 2-D

FERPA is the foundational federal law on the privacy of students’ educational records.  Generally, FERPA safeguards student privacy by limiting who may access student records, specifying for what purpose they may access those records, and detailing what rules they have to follow when accessing the data.

In addition to FERPA, Section 2-D and its corresponding regulations (Part 121) similarly impose an obligation on school districts to ensure that student and certain teacher or principal data is safeguarded through a series of protective measures. Specifically, Section 2-D requires school districts to publish on their websites a Parents’ Bill of Rights for Data Privacy and Security, which provides information to parents, guardians and eligible students about certain legal requirements that protect personally identifiable information (“PII”).  Section 2-D also provides very specific protections for contracts with “third party contractors” that receive access student, teacher, or principal data from school districts. 

Recent NYSED Memorandum

On July 19, 2023, NYSED’s Privacy Officer issued a memorandum expressing the Department’s intention to begin monitoring school districts’ websites for compliance with Section 2-D and FERPA. The memorandum focuses on best practices for privacy and data security, and provides a checklist of protective measures, including: (1) whether a parents’ bill of rights is posted on the website; (2) whether there is information on the website regarding how parents and students can file a complaint; (3) whether there is supplemental information to the parents’ bill of rights provided on the website for contracts with a third party contractor; and (4) whether the school district’s data security and privacy policy aligns with the National Institute of Standards and Technology, as required by § 121.5(b) of the Regulations of the Commissioner of Education.

The memorandum indicates that NYSED will begin its enforcement efforts in Fall 2023. Thus, school districts should begin evaluating their websites as soon as possible for compliance before the start of the upcoming school year.