South Orangetown Central School District

Parents Bill of Rights for Data Privacy & Security

Pursuant to Section 2-c and 2-d of the Education Law, parents and students are entitled to certain protections regarding confidential student information. The District is committed to safeguarding personally identifiable information from unauthorized access or disclosure as set forth below:

  1. A student’s personally identifiable information cannot be sold or released for any commercial purposes;
  2. Parents have the right to inspect and review the complete contents of their child’s education record;
  3. The District is committed to implementing safeguards associated with industry standards and best practice under state and federal laws protecting the confidentiality of personally identifiable information, including but not limited to, encryption, firewalls, and password protection when data is stored or transferred;
  4. A complete list of all student data elements collected by the State is available for public review online at http://www.nysed.gov/student-data-privacy/schools/data-elements-collected or by writing to: Information & Reporting Services, New York State Education Department – Room 863 EBA, 89 Washington Avenue, Albany, NY 12234.
  5. Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be made in writing to: South Orangetown Central School District, Attn: District Clerk, 160 Van Wyck Road, Blauvelt, NY 10913;
  6. The District has entered into contracts with certain third party contractors who have been sent student data and/or teacher data and/or principal data. The following information is required by law:
    1. The names of the third party contractors, the exclusive purpose(s) for which the data will be used;
    2. The commencement and termination dates of each such agreement;
    3. A description of how the data will be disposed by the contract when the contract purpose has been fulfilled;
    4. The data storage and security measures undertaken
  7. Agreements with third party contractors will ensure that the subcontractors, persons or entities that the third part contractor will share the student data or teacher or principal data with, if any, will abide by data protection and security requirements;
  8. A parent, student eligible student, teacher or principal may challenge the accuracy of the student data or teacher or principal data that is collected by filing a written request with the Superintendent of Schools or the District Clerk: South Orangetown Central School District, Attn: District Clerk, 160 Van Wyck Road, Blauvelt, NY 10913.

Supplemental Information for Third-Party Contracts

The South Orangetown CSD (the “District”) has entered into contracts with certain third party contractors who have been sent student data and/or teacher data and/or principal data. The following information includes the list of vendors.

If a parent, student, principal, or teaching staff member would like to challenge the accuracy of data that has been collected they should submit a written request with the Superintendent of Schools or the District Clerk: South Orangetown Central School District, Attn: District Clerk, 160 Van Wyck Road, Blauvelt, NY 10913.

(1) PowerSchool
a. Student Management system that keeps record of student demographic information, attendance, grades, health/immunizations, schedules and contact information.
b. PowerSchool will not share any student information or data obtained pursuant to its contract with the District to subcontractors, research institutions, persons or entities that are not directly an employee or department/office within PowerSchool’s organization or the District, absent consent from the District, the applicable parent and/or eligible student unless required to do so to comply with legal process and/or a Court Order.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be stored on the District premises and is in sole ownership of the South Orangetown Central School District.
d. During the term of and after this agreement expires, the student data is kept on the District property and is protected by the BOCES regional firewall and an Intrusion Detection System.

(2) STAR Renaissance
a. Student assessment tool that helps educators build individualized instruction to accelerate learning for all students. Grades K-8.
b. STAR Renaissance will not share any student information or data obtained pursuant to its contract with the District to subcontractors, research institutions, persons or entities that are not directly an employee or department/office within STAR Renaissance’s organization or the District, absent consent from the District, the applicable parent and/or eligible student unless required to do so to comply with legal process and/or a Court Order.
c. Absent renewal, this agreement expires on 30th day of June each year. After the expiration of this agreement, the student information becomes the sole ownership of the District.
d. During the term of and after this agreement expires, the student data is kept at the Southern Westchester BOCES property and is protected by a Cisco firewall and an Intrusion Detection System.

(3) Achieve 3000
a. Differentiated online instruction to improve students’ reading and writing levels and help to increase their literacy proficiency to reach the 1300 lexile level.
b. Achieve3000 complies with applicable provisions of the Children’s Online Privacy Protection Act (CPPA), which regulates how the operators of commercial websites directed to children may collect, use and disclose individually identifiable personal information concerning children.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be removed from the Achieve 3000 system.
d. Achieve3000 ensures that all information that it receives is secure against unauthorized access by maintaining it on a secure system that is isolated from direct connection to the Internet. The servers are housed on the main property of Achieve 3000.

(4) Naviance
a. Naviance is a college readiness platform that helps connect academic achievement to post-secondary goals
b. Naviance has security measures in place to help protect against the loss, misuse and alteration of the data under Naviance’s control. When Naviance’s platform is accessed using a supported web browser, Secure Socket Layer (SSL) technology protects information using both server authentication and data encryption to help ensure that data is safe, secure and available only to authorized users.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be removed from the Naviance system.
d. Naviance implements an advanced security method based on dynamic data and encoded session identifications, and hosts its college readiness platform in a secure server environment that uses a firewall and other advanced technology in an effort to prevent interference or access from outside intruders. The Naviance college readiness platform requires unique account identifiers, user names and passwords that must be entered each time a client or user signs on. These safeguards help to prevent unauthorized access, maintain data accuracy and ensure the appropriate use of data.

(5) IEP / RTI Direct
a. IEP Direct is a state-specific solution for managing Special Education programs and IEP’s. RTI Direct is a solution for managing Response to Intervention programs.
b. IEP Direct agrees to hold all Confidential Information in strict confidence and not to copy, reproduce, sell, transfer, or otherwise dispose of, give or disclose such Confidential Information to third parties other than employees, agents, or subcontractors of IEP Direct or the District who have been authorized by the District to have access. IEP Direct has agreed in writing to advise and require its employees, agents, and subcontractors to keep all personally identifiable student information and data confidential and shall be responsible to the District for any breach of this obligation by its employees, agents, and subcontractors.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be removed from the IEP Direct system.
d. During the term of this agreement, student data is kept at the Southern Westchester BOCES property and is protected by a Cisco firewall and an Intrusion Detection System.

(6) Transfinder
a. Transfinder is a school bus routing software application used for student transportation.
b. Transfinder will not sell, rent, or intentionally disclose personal information that the District provides to it us, unless: (a) Transfinder is required to do so by law, regulation, warrant, subpoena or court order, (b) Transfinder is required in urgent circumstances to protect the personal safety of Transfinder employees, users of Transfinder products or services, or members of the public, or to enforce the Terms of Use of its Agreement with the District; or (c) such disclosure is part of a sale of all (or substantially all) of the assets of Transfinder.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be stored on the District premises and is in sole ownership of the District.
d. During the term of and after this agreement expires, student data is kept on the District property and is protected by a Cisco firewall and an Intrusion Detection System.

(7) My Learning Plan
a. My Learning Plan is a web-based educator evaluation and professional learning data management solution.
b. The My Learning Plan website has security measures in place to protect the loss, misuse and alteration of the information under its control. My Learning Plan limits access to personal information to members of its staff who it believes reasonably need to come into contact with that information to provide products or services to the District or in order to do their jobs. My Learning Plan will not rent, sell, or share personal information about the District employees with other people or nonaffiliated companies.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be removed from the My Learning Plan system.
d. Access to MyLearningPlan.com account information is password-protected so that only authorized users have access to personal information. During the term of this agreement, student data is kept at the Southern Westchester BOCES property and is protected by a Cisco firewall and an Intrusion Detection System.

(8) Horizon – My Payments Plus
a. Solana/My Payments Plus are a school meal application used for charging meals to student accounts.
b. Horizon will not disclose your personally identifiable information to outside parties except: (i) to the extent necessary to provide you with a service you purchased from Horizon, which is provided by a third party under contract with Horizon, (ii) when we believe in good faith that any applicable law, regulation, or legal process requires disclosure; or (iii) when we believe disclosure is necessary to protect or enforce our rights or the rights of another customer. We may also collect customer information on an aggregate basis and disclose the aggregate data to prospective partners or other outside parties. Aggregate customer statistics are not personally traceable to you. We may also provide information to governmental agencies or other companies assisting us in fraud prevention or investigation, when: (1) permitted or required by law; (2) attempting to protect you, another customer or Horizon against actual or threatened fraud; or (3) investigating fraud that has already taken place.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the student data will be stored on the District premises and is in sole ownership of the South Orangetown Central School District.
d. Access to Solana/My Payments Plus account information is password protected so that only authorized users have access to personal information. During the term of this agreement, student data is kept at Horizon.

(9) Frontline Education – Aesop
a. Aesop is an online attendance system that manages absence requests and finds substitutes for teaching staff.
b. Frontline Education or Occam may disclose staff Personal Information to parties outside Occam when they have a good faith belief that disclosure is reasonably necessary to (a) comply with a law, regulation or compulsory legal request; (b) protect the safety of any person from death or serious bodily injury; (c) prevent fraud or abuse of Occam or its users; or (d) to protect Occam’s property rights.
Where personal information has been requested by any governmental entity or other third party pursuant to subpoena or similar legal process, they will notify the staff member as quickly as practicable before providing any such information, unless they are legally prohibited from doing so or they believe in good faith that disclosure is or may be necessary to protect life, avoid serious physical injury or property loss or damage, or to prevent or investigate an ongoing crime.
c. Absent renewal, this agreement expires on the 30th day of June each year. After the expiration of this agreement, the staff data will be stored on the District premises and is in sole ownership of the South Orangetown Central School District.
d. Frontline Education/Occam will retain staff Personal Information for as long as the account is active or as needed to provide services. If staff wishes to cancel their account or request that Occam no longer use staff information to provide services, the staff member may delete the account by sending Occam an e-mail at [email protected] Occam may retain and use staff information as necessary to comply with their legal obligations, resolve disputes, and enforce agreements. Consistent with these requirements, they will try to delete staff information quickly upon request.

Access to Frontline Education/Aesop is password protected so that only authorized users have access to staff information. During the term of this agreement, staff data is kept at Frontline Education.

Contact

Technology
160 Van Wyck Road
Blauvelt, NY 10913
(845) 680-1010
Fax: (845) 680-1986

George Brady
Director of Technology

Jeanne Corcoran
Coordinator of Assessment, Data & Accountability

Nadeem Akhter
Information Services & Audio Visual Specialist

Karen Hogdahl
Secretary to the Director of Technology