§ 2-c. Release of student information to certain entities. 1. Definitions. As used in this section the following terms shall have the following meanings:
a. "Student information" shall mean personally identifiable information and biometric records as such terms are defined in section 99.3 of title 34 of the code of federal regulations implementing the Family Education Rights and Privacy Act, as such federal law and regulations are from time to time amended, or any other individual student records and shall also include de-identifiable information which means a collection of data or information that has been altered with the goal of making the student or students associated with such data or information permanently unknowable.
b. "Personally identifiable information" shall mean personally identifiable information as defined in section 99.3 of title 34 of the code of federal regulations implementing the Family Education Rights and Privacy Act, section 1232-g of title 20 of the United States code, as such federal law and regulations are from time to time amended.
c. "Shared learning infrastructure service provider" or "SLISP" shall mean any entity that collects, stores, organizes, or aggregates student information and contracts with or enters into an agreement with the department for the purposes of providing student information to a data dashboard operator for use in a data dashboard. Provided that the term SLISP shall not include boards of cooperative educational services or regional information centers operated by boards of cooperative educational services or other public entities.
d. "Data dashboard" shall mean an electronic data system or hosted software application or applications that is designed to utilize data and information collected, stored, organized or aggregated by a SLISP and that is designed to provide, through a contract between a New York school district and a data dashboard operator, end users such as educators, students and their families with access to customized student information with the goal of supporting instruction and student learning.
e. "Data dashboard operator" shall mean any third party contractor owning or operating a data dashboard that contracts or otherwise enters into an agreement to utilize data and information from a SLISP.
f. "Educational agency" shall mean any public school district, board of cooperative educational services, special act school district, public school kindergarten program, universal pre-kindergarten programs authorized pursuant to section thirty-six hundred two-e of this chapter, publicly funded pre-kindergarten programs, approved preschool special education programs pursuant to section forty-four hundred ten of this chapter, approved private school for the education of students with disabilities and a state supported or state operated school subject to the provisions of article eighty-five, eighty-seven or eighty-eight of this chapter.
g. "Student" shall mean any person attending an educational agency identified in paragraph f of this subdivision.
2. An educational agency may opt out of providing personally identifiable information to a SLISP or data dashboard operator for the purpose of creating data dashboards. An educational agency may at any time request that any personally identifiable information associated with such agency not be shared or provided to a SLISP or data dashboard operator. Such request shall be made to the department and upon receipt of such request, the department shall take all actions necessary to prevent and prohibit the sharing or providing of such information to any SLISP or data dashboard operator and that upon receipt of such request, the department shall take actions to immediately ensure that any personally identifiable information provided to any SLISP or data dashboard operator is deleted from such SLISP or operator and destroyed in a secure manner.
3. The commissioner and the department are hereby prohibited from providing any student information to a SLISP and the commissioner and department shall take actions to immediately ensure that any student information provided to any SLISP shall be deleted from such SLISP and destroyed in a secure manner.
