This law is focused on the privacy and security of personally identifiable information (PII) of students, classroom teachers and principals. The regulations reiterate that education agencies must publish a parent’s bill of rights for data privacy and security, as required by the current Education Law 2-d. In addition, the parent’s bill of rights must be included with every contract with a third-party contractor that receives PII.

The Board of Regents adopted Part 121 of the Regulations of the Commissioner of Education on January 13, 2020. These rules will implement Education Law Section 2-d and provide guidance to educational agencies and their third-party contractors on ways to strengthen data privacy and security to protect student data and annual professional performance review data. The regulation went through multiple sets of revisions and three rounds of public comments and went into effect January 29, 2020.