The New York State Education Department (“NYSED”) recently issued a memorandum indicating it will begin monitoring school districts’ websites in the fall 2023 for compliance with New York State Education Law § 2-D (“Section 2-D”) and the Family Educational Rights and Privacy Act (“FERPA”). Accordingly, school districts should ensure that their websites are compliant with these privacy laws prior to the start of the 2023-2024 school year.
Overview of FERPA and Section 2-D
FERPA is the foundational federal law on the privacy of students’ educational records. Generally, FERPA safeguards student privacy by limiting who may access student records, specifying for what purpose they may access those records, and detailing what rules they have to follow when accessing the data.
In addition to FERPA, Section 2-D and its corresponding regulations (Part 121) similarly impose an obligation on school districts to ensure that student and certain teacher or principal data is safeguarded through a series of protective measures. Specifically, Section 2-D requires school districts to publish on their websites a Parents’ Bill of Rights for Data Privacy and Security, which provides information to parents, guardians and eligible students about certain legal requirements that protect personally identifiable information (“PII”). Section 2-D also provides very specific protections for contracts with “third party contractors” that receive access student, teacher, or principal data from school districts.
Recent NYSED Memorandum
The memorandum indicates that NYSED will begin its enforcement efforts in Fall 2023. Thus, school districts should begin evaluating their websites as soon as possible for compliance before the start of the upcoming school year.