S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                    423
 
                        2023-2024 Regular Sessions
 
                           I N  A S S E M B L Y
 
                              January 9, 2023
                                ___________
 
 Introduced  by M. of A. EPSTEIN -- read once and referred to the Commit-
   tee on Education
 
 AN ACT to amend the education law,  in  relation  to  requiring  consent
   prior to sharing certain student information
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:

   Section 1. Paragraph e of subdivision 5 of section 2-d of  the  educa-
 tion law, as added by section 1 of subpart L of part AA of chapter 56 of
 the laws of 2014, is amended to read as follows:
   e.  Each educational agency that enters into a contract or other writ-
 ten agreement with a third party contractor under which the third  party
 contractor  will receive student data or teacher or principal data shall
 ensure that such contract or agreement  includes  a  data  security  and
 privacy  plan that outlines how all state, federal, and local data secu-
 rity and privacy contract requirements will be implemented over the life
 of the contract, consistent with the educational agency's policy on data
 security and privacy. Such plan shall include, but shall not be  limited
 to,  a  signed  copy  of the parents bill of rights for data privacy and
 security, and a requirement that any officers or employees of the  third
 party  contractor  and  its assignees who have access to student data or
 teacher or principal data have received or will receive training on  the
 federal  and  state  law governing confidentiality of such data prior to
 receiving access. NO STUDENT DATA SHALL BE  RELEASED  PURSUANT  TO  THIS
 PARAGRAPH  WITHOUT  OBTAINING  WRITTEN CONSENT OF THE PARENT OR ELIGIBLE
 STUDENT.
   § 2. Section 2-c of the education law  is  amended  by  adding  a  new
 subdivision 4 to read as follows:
   4.  NO EDUCATIONAL AGENCY SHALL RELEASE PERSONALLY IDENTIFIABLE INFOR-
 MATION TO A SLISP OR DATA DASHBOARD OPERATOR WITHOUT  OBTAINING  WRITTEN
 CONSENT  OF THE PARENT OR ELIGIBLE STUDENT, AS SUCH TERMS ARE DEFINED IN
 SECTION TWO-D OF THIS ARTICLE.
   § 3. This act shall take effect on the thirtieth day  after  it  shall
 have become a law.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
              

                       [ ] is old law to be omitted.
                                                            LBD00124-01-3