BROOME-TIOGA BOCES
PARENTS’ BILL OF RIGHTS FOR DATA PRIVACY AND SECURITY
Broome-Tioga BOCES (BT BOCES) is committed to protecting the privacy and security of student,
teacher, and principal data. In accordance with New York Education Law §2-d, BT BOCES wishes to inform parents and eligible students of the following:
1. Personally identifiable information (PII) cannot be sold or released for any commercial purpose.
2. The right to inspect and review the complete contents of the student's education records.
3. State and federal laws protect the confidentiality of personally identifiable information (PII) and the safeguards associated with industry standards and best practices, including, but not limited to, encryption, firewalls, and password protection must be in place when data is stored or transferred.
4. A complete list of all data elements collected by the state is available for public review at http://www.nysed.gov/data-privacy-security/student-data-inventory, or by contacting the New York State Education Department (NYSED) Chief Privacy Officer by mail, phone, or email as noted below*:
Chief Privacy Officer
New York State Education Department
89 Washington Avenue, EB 152
Albany, NY 12234
Phone: 518-474-0937
Email: [email protected]
*For the most up-to-date contact information, please visit: https://www.nysed.gov/data-privacy-security/contact-information
5. The right to have complaints about possible breaches and unauthorized disclosures of student data addressed. Complaints may be submitted to the BT BOCES Data Protection Officer at:
Broome-Tioga BOCES
Attn: Data Protection Officer
435 Glenwood Road
Binghamton, NY 13905
Complaints pertaining to the State Education Department or one of its third-party vendors should be directed in writing to the Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, EB 152, Albany, NY 12234, via email at [email protected], or phone at 518-474-0937.
6. To be notified in accordance with applicable laws and regulations if a breach or unauthorized release of their
student’s PII occurs.
Supplemental Information Addendum
Parents Bill of Rights and Additional Data Protection Requirements
In the course of complying with its obligations under the law and providing educational services, Broome-
Tioga BOCES has entered into agreements with certain third-party contractors. Pursuant to such agreements, third-party contractors may have access to “student data” and/or “teacher or principal data” as those terms are defined by law.
Each contract BT BOCES enters into with a third-party contractor, where the third-party contractor receives student data or teacher or principal data, will include the following information:
1. EXCLUSIVE PURPOSES FOR DATA USE: The exclusive purposes for which “student data” or “teacher or principal data” (as those terms are defined in Education Law §2-d and collectively referred to as the “Confidential Data”) will be used by the “Contractor” are limited to the purposes authorized in the contract between the Contractor and Broome-Tioga BOCES as outlined in the Contract or Data Protection
Agreement.
2. SUBCONTRACTOR OVERSIGHT DETAILS: The Contractor will ensure that any subcontractors, or other authorized persons or entities to whom the Contractor will disclose the Confidential Data, if any, are contractually required to abide by all applicable data protection and security requirements, including but not limited to those outlined in applicable state and federal laws and regulations (e.g., FERPA; Education Law §2-d, 8 NYCRR Part 121).
3. CONTRACT PRACTICES: The Contract commences and expires on the dates set forth in the Contract, unless earlier terminated or renewed pursuant to the terms of the Contract. On or before the date the Contract expires, protected data will be exported to the BT BOCES and destroyed by the Contractor as directed by BT BOCES.
4. DATA ACCURACY/CORRECTION PRACTICES: A parent or eligible student can challenge the accuracy of any “education record”, as that term is defined in the Family Educational Rights and Privacy Act (“FERPA”) stored by BT BOCES in a Contractor’s product and/or service by following BT BOCES’s procedure for requesting the amendment of education records under FERPA. Teachers and principals may be able to
challenge the accuracy of APPR data stored by BT BOCES in the Contractor’s product and/or service by following the appeal procedure in BT BOCES APPR Plan. Unless otherwise required above or by other applicable law, challenges to the accuracy of the Confidential Data shall not be permitted.
5. SECURITY PRACTICES: Confidential Data provided to Contractor by BT BOCES will be stored securely and encrypted both in transit and at rest. The measures that Contractor takes to protect Confidential Data will align with the NIST Cybersecurity Framework including, but not necessarily limited to, disk encryption, file encryption, firewalls, and password protection. The Contractor shall establish a data security and
privacy plan which it will make available to BT BOCES.
6. ENCRYPTION PRACTICES: The Contractor will apply encryption to the Confidential Data while in motion and at rest at least to the extent required by Education Law §2-d and other applicable laws.
7. NOTIFICATION OF BREACH: Contractor shall promptly notify BT BOCES of any breach or unauthorized release of personally identifiable information in the most expedient way possible and without unreasonable delay but no more than seven calendar days after the discovery of such breach. The Contractor shall cooperate with BT BOCES, educational agencies and law enforcement to protect the integrity of
investigations into the breach or unauthorized release of personally identifiable information.
Updated: February 2024