All names and identifying district/school information have been removed.
December 11, 2013
Re: Service Agreement deletion clause and violation of New York Personal Privacy Law
Dear Dr. ____________:
As a concerned parent (omitted school name), I have continuously expressed my valid concerns regarding my child’s personally identifiable information being shared with the New York State Education Department (NYSED) and a company called InBloom (formerly known as Shared Learning Collaborative, LLC.) I have spoken about my concerns at many Board of Education meetings and have sent you and our Board of Education numerous emails addressing my concerns. At our meeting last week, you requested my specific questions in writing so that you may forward them to the district’s counsel.
First, InBloom (when they were known as SLC) entered into an agreement with NYSED. Please see http://usny.nysed.gov/rttt/docs/slc-service-agreement.pdf (“SLC Agreement”). This agreement has several attachments. Attachment F of the agreement has exhibits annexed, as well. Exhibit “C” of Attachment F contains a provision labeled “3.8 District Opt-Out from SLI” that provides the following: “If a school district decides they no longer wish to use the SLI system, they may request that district student data be deleted from the SLI data store. SLI will have a mechanism to delete these records from the data store.”
During our meeting, you suggested this provision permitting districts to delete student data only applies after the two year period the district is obligated to utilize InBloom per the agreement between our district and NYSED. Please note that there is no reference to the Service Agreement between SLC and InBloom in the Memorandum of Understanding between our district and NYSED.
Second, as I explained during our meeting, although FERPA is applicable to New York State school districts, FERPA is the floor, not the ceiling. Thus, FERPA would not preempt New York law. Interestingly, New York State Law provides greater protection than FERPA. New York’s Personal Privacy Law provides that personal information may not be disclosed without “voluntary written consent of the data subject.” (See Article 6-A of the Public Officers Law, N.Y. Pub. Off. Law §96(1)(a).
My questions are as follows:
1) What is the source of the determination that the deletion provision in the agreement between the state and InBloom does not apply until after the two (2) year period; and
2) What gives the district and/or the state the authority to share a child’s personal information with InBloom without voluntary written consent of the child’s parent or guardian under New York Personal Privacy Law?
I thank you for your continued commitment to the children of _________ District and I trust you will continue to protect our children.