Skip To Main Content

Data Security and Privacy Plan Agreement

Required

ADDENDUM
DATA SECURITY AND PRIVACY PLAN
Namerequired
First Name
Last Name
(hereinafter “Third-party Contractor”) and Nyack Union Free School District, having offices at 13A Dickinson Avenue, Nyack, New York 10960 (hereinafter “School District”) hereby agree to make this Data Security and Privacy Plan part of their Agreement for services (the “Agreement”) and attach it as an Addendum to that Agreement.
 
1. Definitions: Terms used in this Data Security and Privacy Plan (the “Plan”) shall have the same meanings as those found in New York Education Law Section 2-d(1) and the Regulations of the New York Commissioner of Education at Section 121.1 of Title 8 of the New York Codes, Rules and Regulations (8 NYCRR § 121.1), unless more broadly defined herein.
 
2. Confidential Information. Third-party Contractor understands that in performing its Agreement with the School District, Third-party Contractor, its employees, officers, agents and subcontractors may have access to confidential information in the possession of the School District, including, but not limited to names, facts or information about individuals, businesses and families. Third-party Contractor may also have access to or acquire confidential information, potentially including student data, student directory information, student records, teacher or principal data, personnel information and records, information regarding sensitive, confidential or internal School District matters and other protected information. For purposes of this Plan and the Agreement, it is agreed that the definition of Confidential Information includes all documentary, electronic or oral information made known to Third-party Contractor through any activity related to the Agreement, except information available to Third-party Contractor from third parties on an unrestricted basis. Third-party Contractor understands that any unauthorized disclosure, publication and/or communication of such Confidential Information shall be considered a breach of this Plan and the Agreement. Third-party Contractor agrees that if he/she/it receives a request for disclosure of confidential information obtained from the School District, including but not limited to student data or teacher or principal data as defined by New York Education Law Section 2-d, pursuant to a statute, subpoena or court order, he/she/it shall notify the School District prior to disclosing the School District’s confidential information, unless providing notice of the disclosure is expressly prohibited by the statute, subpoena or court order.
 
3. Without limiting any of the foregoing statements, Third-party Contractor further agrees:
 
a. To execute, comply with and incorporate as Exhibit “1” to this Plan, as required by New York State Education Law Section 2-d and its implementing regulations, the Parents’ Bill of Rights for Data Privacy and Security developed by the School District;
 
b. To adopt technologies, safeguards and practices that align with the NIST Cybersecurity Framework;
 
c. To comply with the data security and privacy policy of the School District, New York Education Law Section 2-d and Part 121 of the Regulations of the Commissioner of Education as well as any changes to the policy, law and regulations that may be enacted, adopted and/or become effective during the term of the Agreement;
 
d. Not to sell, use or disclose personally identifiable student, teacher or principal data or information for any marketing or commercial purpose or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so;
 
e. Not to use the education records of the School District or any personally identifiable student, teacher and/or principal information or data of the School District, as those terms are defined in Education Law Section 2-d and Part 121 of the Regulations of the Commissioner of Education, for any purpose other than those explicitly authorized in this Plan or the Agreement;
 
f. To use and maintain reasonable administrative, technical and physical safeguards and practices that align with the NIST Cybersecurity Framework and are otherwise consistent with industry standards and best practices, including but not limited to encryption technology, firewalls and password protection, to protect the security, confidentiality and integrity of personally identifiable student, teacher and/or principal information or data of the School District while in motion or in the custody of Third-party Contractor from unauthorized disclosure as prescribed by state and federal law, regulations, and the Agreement and the Third-party Contractor represents and warrants that it has the following safeguards and practices in place to protect personally identifiable information that it receives, maintains, stores, transmits or generates pursuant to the Agreement:
g. To limit internal access within Third-party Contractor to personally identifiable student, teacher and principal information and data of the School District to only those officers, directors, employees, or authorized sub-contractors or assignees of the Third-party Contractor that are determined to need access to such records or data to perform the services set forth in the Agreement;
to protect personally identifiable student, teacher and or principal information or data of the School District in Third-party Contractor’s custody while in motion or at rest from unauthorized disclosure;
 
i. Not to disclose any personally identifiable student, teacher or principal information or data of the School District, as those terms are defined in Education Law Section 2-d and Part 121 of the Regulations of the Commissioner of Education, directly or indirectly, to any other party who is not an officer, director, employee or authorized subcontractor or assignee of the Third-party Contractor using the data or information to carry out Third-party Contractor’s obligations under the Agreement in compliance with New York State and federal law, regulations, and the Agreement, unless
 
i. the other party has the prior written consent of the applicable student’s parent/guardian or of the eligible student; or
 
ii. the other party has the prior written consent of the applicable teacher or principal; or
 
iii. the disclosure to the other party is required by statute, subpoena or court order and the Third-party Contractor provides a notice of disclosure to the New York State Education Department or the School District no later than the time the information is disclosed, unless providing notice of disclosure is expressly prohibited by the statute, subpoena or court order;
 
j. To impose on any sub-contractor engaged by Third-party Contractor, with the consent of the School District, to perform any of its obligations under the Agreement the requirement to comply with all the confidentiality and data privacy and security obligations imposed on Third-party Contractor in the Agreement and by state and federal law and regulations, including but not limited to Section 2-d of New York State Education Law and Part 121 of the Regulations of the New York State Commissioner of Education;
 
k. In the event that a student’s parent or guardian or an eligible student seeks to challenge the accuracy of student data pertaining to the particular student, which data may include records maintained, stored, transmitted or generated by the Third-party Contractor pursuant to this Agreement, the challenge will be directed to the School District and processed in accordance with the School District’s procedures;
 
l. In the event that a teacher or principal seeks to challenge the accuracy of teacher or principal data pertaining to the particular teacher or principal, which data may include records maintained, stored, transmitted or generated by the Third-party Contractor pursuant to this Agreement, the challenge will be directed to the School District and processed in accordance with the procedures the School District has established for challenging annual professional performance review (“APPR”) data;
 
m. To immediately notify the School District in the most expedient way possible and without unreasonable delay and in no event more than seven (7) calendar days after discovering that any personally identifiable information of the School District, its employees, students, teachers, principals or administrators is breached and/or released without authorization;
 
n. To take immediate steps to limit and mitigate to the greatest extent practicable the damages arising from any breach or unauthorized release of any personally identifiable information of the School District, its employees, students, teachers, principals or administrators;
 
o. In the event of a breach or unauthorized release of any personally identifiable data or information of the School District, its employees, students, teachers or administrators by or attributable to Third-party Contractor, Third-party Contractor must pay for or promptly reimburse the School District for the full cost of any notifications the School District makes as a result of the breach or unauthorized release;
 
p. To cooperate with the School District and other parties to protect the integrity of investigations into the breach or unauthorized release of personally identifiable data or information.
 
q. Parents and/or guardians of students attending the School District’s schools have the right to inspect and review the complete contents of their child's education record, which may include records maintained, stored, transmitted, and/or generated by Third-party Contractor; and
 
r. In the event Third-party Contractor breaches any of the privacy and confidentiality provisions of this Plan or the Agreement, the School District, at its sole discretion, may immediately terminate the Agreement.
6. The Third-party Contractor represents and warrants that the information contained in the Supplemental Information portion of the Parents’ Bill of Rights for Data Privacy and Security of the School District with respect to the Agreement, as stated in Exhibit 1 to this Plan, is accurate
Will the Third-party Contractor utilize sub-contractors in the performance of the Agreement?(check one)
(check one)
9. Upon the expiration or termination of the Agreement, if requested by the School District, the Third-party Contractor will assist the School District in exporting all student, teacher or principal data previously received by the Third-party Contractor or generated by the Thirdparty Contractor pursuant to the Agreement. In addition all information and data of the School District remaining in the possession of the Third-party Contractor will be(check those that are applicable and fill in required information)
(check those that are applicable and fill in required information)
[date] in the following format(s): (Must contain a date in MM/DD/YYYY format)
[date] in the following manner: (Must contain a date in MM/DD/YYYY format)
10. It is understood that further revisions to this Plan or the Agreement may be necessary to ensure compliance with New York State Education Law Section 2-d if School District policies are adopted or revised or if New York Education Law Section 2-d and Part 121 of the Regulations of the Commissioner of Education are amended. Third-party Contractor and the School District agree to take such additional steps as may be necessary at that time to facilitate compliance with New York Education Law Section 2-d and Part 121 of the Regulations of the Commissioner of Education.
 
11. The parties further agree that the terms and conditions set forth in this Plan shall survive the expiration and/or termination of the Agreement.
 
12. The undersigned representative of Third-party Contractor hereby represents and warrants that the undersigned is the owner or an officer, director, or agent of Third-party Contractor with full legal rights, power and authority to enter into this Addendum on behalf of Third-party Contractor and to bind Third-party Contractor with respect to the obligations enforceable against Third-party Contractor in accordance with its terms.
 
IN WITNESS WHEREOF, the parties have executed this Addendum on
 
[insert date on which Addendum is signed].
 
 
NYACK UNION FREE SCHOOL DISTRICT
Name:
First Name
Last Name
INSERT NAME OF THIRD-PARTY CONTRACTOR
Name:
First Name
Last Name
EXHIBIT 1
 
Parents’ Bill of Rights for Data Privacy and Security
 
In accordance with New York State Education Law Section 2-d, the Nyack Union Free School District (the “District”) hereby sets forth the following Parents’ Bill of Rights for Data Privacy and Security, which is applicable to all students and their parents and legal guardians.
 

(1) State and federal laws, such as New York State Education Law Section 2-d (“Section 2-d”) and the Family Educational Rights and Privacy Act (“FERPA”) protect the confidentiality of personally identifiable information. Subject to certain exceptions (See Regulation 5500-R), Section 2-d and FERPA assures the confidentiality of student records with respect to "third parties," and provides parents with the right to consent to disclosures of personally identifiable information contained in their child’s education records.

(2) A student's personally identifiable information cannot be sold or released for any marketing or commercial purposes by the District or any third party contractor.

(3) Personally identifiable information includes, but is not limited to:

i. The student's name;

ii. The name of the student's parent or other family members;

iii. The address of the student or student's family;

iv. A personal identifier, such as the student's social security number, student number, or biometric record;

v. Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;

vi. Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

vii. Information requested by a person who the District reasonably believes knows the identity of the student to whom the education record relates.

(4) Personally identifiable student information will be collected and disclosed only as necessary to achieve educational purposes in accordance with state and federal laws.

(5) In accordance with FERPA, Section 2-d and Nyack Public Schools Board of Education Policy number 5500 “Student Records”, parents have the right to inspect and review the complete contents of their child's education record.

(6) The District has the following safeguards in place to protect student data, a Fortinet firewall, Intrusion Detection System, AES (Advanced Encryption Standard 256) bit for VPN encryption, SHA (Secure Hashing Algorithm) for VPN message integrity and file and folder security settings to restrict access and passwords protocol, including personally identifiable information stored or transferred by the District.

(7) New York State, through the New York State Education Department, collects a number of student data elements for authorized uses. A complete list of all student data elements collected by the State is available for public review, at http://www.nysed.gov/data-privacy-security/student-data-inventory or may be obtained by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234.
 
(8) Parents have the right to submit complaints about possible breaches and unauthorized disclosures of personally identifiable student data addressed. Any such complaint should be submitted, in writing, to: Nyack Public Schools, Attn: Data Protection Officer, of 13A Dickinson Ave, Nyack, NY 10960 or by email to dnicolosi@nyackschools.org. Complaints may also be directed to the Chief Privacy Officer the New York State Education Department online at http://www.nysed.gov/data-privacy-security/report-improper-disclosure or by mail to Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany NY 12234, or by email to Privacy@mail.nysed.gov.
 
Attach up to 1 file with a maximum size of 10MB
No file chosen
Name:required
First Name
Last Name
Must contain a date in MM/DD/YYYY format
hereinafter “Third-party Contractor”).
The Third-party Contractor will provide the following information and Nyack Public School District (the “ District”) will review and approve or require revision of this Supplemental Information until it is acceptable to the District.
(date)
(date)
Upon the expiration of the Agreement, all student data or teacher or principal data remaining in Third-party Contractor’s possession will be:(check those that are applicable and fill in required information)
(check those that are applicable and fill in required information)
(date)
(date)
(4) A parent, student, teacher or principal can challenge the accuracy of the Data received by or generated by the Third-party Contractor in writing addressed to Nyack Public Schools, Attn: Data Protection Officer, 13A Dickinson Ave, Nyack, NY 10960 or by email to dnicolosi@nyackschools.org.
NYACK UNION FREE SCHOOL DISTRICT
Name:
First Name
Last Name
INSERT NAME OF THIRD-PARTY CONTRACTOR
Name:
First Name
Last Name

Please complete the security verification below.