How New York parents can protect a child’s education data
Schools collect student information for enrollment, instruction, assessments, special education, transportation, and other services. Some records are maintained by the district, while others may be stored by software companies, testing contractors, or nonprofit partners.
New York’s Parents’ Bill of Rights for Data Privacy and Security gives families tools to understand these practices and challenge improper handling of personally identifiable information. Parents can use those rights alongside federal protections such as FERPA and their district’s published privacy policies.
The most effective approach is practical: learn what the school collects, identify who receives it, keep written records, and raise concerns through the correct local and state channels.
Learn what information the school holds
Begin by requesting access to your child’s personally identifiable information, often called PII. This may include names, dates of birth, student identification numbers, addresses, grades, attendance, disciplinary records, disability-related information, assessment results, and other data that can identify a student.
Send the request to the district’s records officer, superintendent, or designated data protection contact. Ask for both the records and a description of the systems in which they are stored. Keep the request specific, dated, and in writing so there is a clear record of your communication.
Ask how data is collected and shared
A school should be able to explain why information is collected, how it is used, and which educational agencies, contractors, or other entities can access it. Ask whether a vendor receives direct identifiers, whether information is de-identified, how long it is retained, and whether it is deleted when a contract ends.
Testing and digital learning programs deserve careful attention. Families reviewing the history and influence of assessment systems can consult standardized testing history, while broader questions about outside organizations and education policy can be informed by policy influence records. These sources can help parents develop precise questions without assuming that every partnership is unlawful.
Understand consent and permitted disclosures
FERPA generally gives parents rights to inspect education records and control many disclosures of PII, subject to legal exceptions. New York’s privacy protections also address the use of student data by educational technology providers and other contractors. A district may disclose information without separate consent in certain circumstances, such as legitimate educational interests, health or safety emergencies, or properly handled directory information.
Check the district’s annual FERPA notice and directory-information policy. If you do not want certain directory information shared, follow the district’s opt-out procedure before its deadline. An opt-out usually does not erase information already required for instruction or school administration, so ask what the restriction covers.
| Action | What to request or review | Why it matters |
|---|---|---|
| Access request | Your child’s records and data categories | Reveals what is stored |
| Vendor review | Contracts, privacy terms, and retention rules | Shows who can use the data |
| Directory opt-out | District deadline and covered items | Limits routine disclosures |
| Correction request | Inaccurate, misleading, or incomplete records | Protects the integrity of the file |
| Complaint | Written facts and supporting documents | Creates a formal enforcement record |
Review vendor safeguards
New York schools must maintain a data privacy and security policy and use reasonable safeguards for student information. Contracts with third-party providers should restrict selling data, targeted advertising, unauthorized reuse, and redisclosure. They should also address encryption, access controls, breach response, subcontractors, and secure destruction.
Ask for the district’s data privacy policy and any publicly available data-sharing agreements related to your child’s program. A refusal to provide basic policy information, vague answers about retention, or an unexplained request for excessive data warrants a written follow-up to the district’s privacy officer or superintendent.
Correct inaccurate or inappropriate records
Parents may request that records be amended when information is inaccurate, misleading, or maintained in a way that violates privacy rights. Identify the exact entry, explain the problem, attach supporting documents, and state the correction you are seeking. Keep the tone factual and retain copies of every submission.
If the district denies the request, ask for the decision and appeal process in writing. A correction dispute may also involve FERPA procedures, special education rules, or state education regulations, depending on the record. Avoid posting your child’s records publicly while seeking help, since public sharing can create additional privacy risks.
Respond to a suspected breach
If you believe data was exposed, misused, or shared with an unauthorized party, report the concern promptly to the school or district privacy contact. Include the date, system or program involved, information potentially affected, people notified, and any screenshots or correspondence. Do not forward sensitive files unnecessarily.
New York law requires educational agencies to address certain breaches and notify affected parties under applicable procedures. Families can also review the district’s breach-response policy and consider filing a complaint with the New York State Education Department when they believe Education Law §2-d or related privacy obligations were violated.
Practical steps for families
- Request your child’s records and the district’s student data privacy policy in writing.
- Review directory-information and technology-program opt-out deadlines each school year.
- Ask which vendors receive data, what they may do with it, and when they must delete it.
- Keep a dated folder containing requests, responses, contracts, notices, and breach communications.
- Escalate unresolved concerns to the superintendent, school board, or appropriate state complaint office.
Protecting student privacy works best when parents participate before a problem occurs. Attend board meetings, read proposed technology agreements, and share accurate information with other families. A documented request can clarify district practices, prompt correction of a record, and help preserve local accountability over children’s education data.