New York posts 'bill of rights' to protect student data

NEW YORK -- The state Education Department has produced a last-minute, preliminary "parents' bill of rights" on the use and security of student data – hours before a legally imposed deadline to do so.

Ken Wagner, deputy education commissioner, sent an email to superintendents and other education officials on Tuesday evening alerting them that a bill of rights had been posted online.

The Journal News reported last week that the department was unlikely to meet its July 29 deadline, set by lawmakers in the state budget. The report also said that school districts were concerned that they might be forced to write their own bills of rights to comply with state law.

Wagner's email seemed to affirm that districts were right. He noted that state law now requires school districts to post a parents' bill of rights on their websites and to include it with every contract that a district signs with a vendor that receives student data.

"We are complying with the law," Education Department spokesman Tom Dunn said Wednesday.

The document will be enhanced once a chief privacy officer is appointed and seeks input from the field, Dunn said. The bill of rights promises that a CPO will develop data-security standards and privacy policies, leading to new state regulations.

Tina Sciocchetti, executive director of the department's Test Security, Data Privacy and Educator Integrity Unit, was appointed interim CPO on Tuesday, he said.

The 11-page bill of rights, which largely summarizes federal and state law regarding data and privacy, was written by department staff based on federal guidelines and the language of the new state law, Dunn said.

Pleasantville schools superintendent Mary Fox-Alter said the new statement summarizes current law but does not include guidance for districts or vendors on protecting student privacy. Districts and their lawyers may still feel they have to interpret state law themselves, she said.

"It's a nicely worded Q-and-A, but I didn't find anything new," said Fox-Alter, who strongly opposed the state's former plans to store student data with a private data cloud. "There needs to be specific guidelines, strong clarity and a consistent message given to vendors and districts."

Regional superintendents have worked with technology centers to create "guiding principles" for the use of student records. They are also drafting their own bill of rights and creating a template agreement for vendors regarding the proper use of student data.

Ken Mitchell, superintendent of South Orangetown schools, who has led the regional data efforts as immediate past president of the Lower Hudson Council of School Superintendents, said school districts still need guidance on whether existing contracts with vendors comply with state law.

"We should not be in a position that requires us to rush this into implementation only to have to modify a few months down the road," he said.

New state law also says that the education commissioner must set a period for parents and others to submit comments and suggestions to a chief privacy officer for possible inclusion in the bill of rights.

Dunn said the department considered naming a current staff member as CPO but later decided to establish a full-time job because of the scope of the work. He said the department is working with other state agencies to create the position.

"None of this has happened, so it's unclear whether this bill of rights is even legal," said Leonie Haimson, an advocate who led opposition to the state's plans to share student data with the now-defunct inBloom data cloud project.

She called the document "shoddy," saying it doesn't spell out parents' rights to see contracts with vendors.

When contacted by The Journal News last week, Education Department officials seemed uncertain that they faced a deadline to produce the bill of rights.

"Clearly, (the Education Department) is dragging its feet and not serious about the direction of legislators to respond in a meaningful way to the outrage of parents and educators," said Lisa Rudley, an Ossining parent and founding member of New York State Allies for Public Education.

Lawmakers in April required the bill of rights, the appointment of a chief privacy officer and other changes to protect student data after there was a statewide backlash against the Education Department's plans to share identifiable student data with inBloom. The law forced New York to pull out of the inBloom project, which closed shortly thereafter.

The bill of rights, written in a question-and-answer format, explains that state law now provides "important new protections for student data, and new remedies for breaches of the responsibility to maintain the security and confidentiality of such data."

Finding new ways to use student data is one of New York's obligations under the federal Race to the Top program, along with the implementation of the Common Core learning standards and a new teacher evaluation system.

The bill of rights is posted here: http://www.p12.nysed.gov/docs/parents-bill-of-rights.pdf.