The New York State Education Law Section 2-D regulation became effective as of July 1, 2019.

As educational agencies in the State of New York collect and maintain personally identifiable information (PII) in the records of their students, the New York State Education Department is working to promote robust information security practices and policies to improve data privacy and security at these state educational agencies.

Education Law Section 2-D defines an “educational agency” as a school, school district, board of cooperative educational services, or the educational department.

The student data protected under this statute is similar to that protected by FERPA. It includes, but is not limited to:

• Student name, or the names of the student’s parents or family members
• Student’s address or addresses of the student’s family
• Personal identifiers, such as biometric records, student number, or social security number
• Indirect identifiers, such as place of birth, date of birth, or mother’s maiden name
• Information that is linked or is linkable to a specific student that would allow someone in the school community (who does not have personal knowledge of relevant circumstances) to identify the student with reasonable certainty
• Information requested by someone who the educational agency or institution believes knows the identity of the student to whom the record relates

Education Law Section 2-D also extends protections to certain confidential annual professional performance review data of teachers and principals. Additionally, the regulation outlines certain requirements of educational agencies and their third-party contractors to ensure the security and privacy of protected information.