New York Codes, Rules and Regulations
Title 8 - EDUCATION DEPARTMENT
Chapter II - Regulations of the Commissioner
Subchapter E - Elementary and Secondary Education
Part 121 - Strengthening Data Privacy and Security in NY State Educational Agencies to Protect Personally Identifiable Information
Section 121.4 - Complaints of Breach or Unauthorized Release of Personally identifiable Information
Current through Register Vol. 46, No. 12, March 20, 2024
(a) Each educational agency must establish and communicate to parents, eligible students, teachers, principals or other staff of an educational agency, its procedures for them to file complaints about breaches or unauthorized releases of student data and/or teacher or principal data.
(b) The complaint procedures must require educational agencies to promptly acknowledge receipt of complaints, commence an investigation, and take the necessary precautions to protect personally identifiable information.
(c) Following its investigation of a submitted complaint, the educational agency shall provide the parent or eligible student, teacher, principal or any other staff member of the educational agency who filed a complaint with its findings within a reasonable period but no more than 60 calendar days from the receipt of the complaint by the educational agency. Where the educational agency requires additional time, or where the response may compromise security or impede a law enforcement investigation, the educational agency shall provide the parent, eligible student, teacher, principal or any other staff member of the educational agency who filed a complaint with a written explanation that includes the approximate date when the educational agency anticipates that it will respond to the complaint.
(d) Educational agencies may require complaints to be submitted in writing.
(e) Educational agencies must maintain a record of all complaints of breaches or unauthorized releases of student data and their disposition in accordance with applicable data retention policies, including the Records Retention and Disposition Schedule ED-1 (1988; rev. 2004), as set forth in section 185.12, Appendix I of this Title.
