S 6784: Requires consent prior to sharing personally identifiable information to a SLISP or data dashboard operator with third party contractors.

  
  STATE OF NEW YORK ________________________________________________________________________ 6784 2025-2026 Regular Sessions  IN SENATE March 24, 2025 ___________ Introduced by Sen. JACKSON -- read twice and ordered printed, and when printed to be committed to the Committee on Education AN ACT to amend the education law, in relation to requiring consent prior to sharing certain student information The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Paragraph e of subdivision 5 of section 2-d of the educa- 2 tion law, as added by section 1 of subpart L of part AA of chapter 56 of 3 the laws of 2014, is amended to read as follows: 4 e. Each educational agency that enters into a contract or other writ- 5 ten agreement with a third party contractor under which the third party 6 contractor will receive student data or teacher or principal data shall 7 ensure that such contract or agreement includes a data security and 8 privacy plan that outlines how all state, federal, and local data secu- 9 rity and privacy contract requirements will be implemented over the life 10 of the contract, consistent with the educational agency's policy on data 11 security and privacy. Such plan shall include, but shall not be limited 12 to, a signed copy of the parents bill of rights for data privacy and 13 security, and a requirement that any officers or employees of the third 14 party contractor and its assignees who have access to student data or 15 teacher or principal data have received or will receive training on the 16 federal and state law governing confidentiality of such data prior to 17 receiving access. No student data shall be released pursuant to this 18 paragraph without obtaining written consent of the parent or eligible 19 student. 20 § 2. Section 2-c of the education law is amended by adding a new 21 subdivision 4 to read as follows: 22 4. No educational agency shall release personally identifiable infor- 23 mation to a SLISP or data dashboard operator without obtaining written 24 consent of the parent or eligible student, as such terms are defined in 25 section two-d of this article. 26 § 3. This act shall take effect on the thirtieth day after it shall 27 have become a law. EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11256-01-5