Determinations of the Chief Privacy Officer
On this page, you will find links to Determinations of the Chief Privacy Officer from December 1, 2021 through current Determinations.
|
Determination |
Date |
Summary |
|---|---|---|
|
12/15/2025 |
Educational agency may disclose student personally identifiable information to other schools in connection with placements under the Individuals with Disabilities in Education Act (Part B) without parental consent so long as such disclosure meets certain other requirements under FERPA. |
|
|
9/23/2025 |
Parent complained that teacher monitored top students' grades without a legitimate educational interest. The Chief Privacy Officer explained that adequate measures must be in place to ensure that school officials have access to only the education records in which they have a legitimate educational interest. |
|
|
6/23/2025 |
Teacher’s inadvertent disclosure of PII in a message to entire class rather than the single intended parent was a breach subject to reporting requirements under Education Law § 2-d. Districts should make staff and administrators aware of written policies regarding communications and transmission of student PII. |
|
|
5/1/2025 |
Parent complained that students were photographed twice despite her submission of an opt-out form. The Chief Privacy Officer urged the district to better train staff and administrators regarding policies for taking photos and videos of students, including implementation of the district’s media authorization form. |
|
|
4/4/2025 |
Parent complained that a gym teacher recorded students during class and posted it to his personal social media. District indicated that such posts were permissible. The Chief Privacy Officer advised the district to have a policy specifically addressing student recordings on staff social media accounts and to make parents aware of what appeared to be its current unwritten policy to permit some posts. Parents should be given the right to control the release of their child’s photographs or other recordings taken at school. |
|
|
3/24/2025 |
Message regarding excessive absences was sent to a group of parents rather than individually, exposing student PII. District admitted the breach and took steps to notify affected families, train staff, and file an incident report with 鶹. |
|
|
11/19/2024 |
Parent complained that the school district improperly disclosed her child’s PII when a leaderboard was shared during an open house, which portrayed students’ names, scores, and ranks on a digital screen. |
|
|
9/12/2024 |
Parent complained that the School District posted pictures of their child on social media without consent in violation of FERPA and Education Law § 2-d. |
|
|
9/10/2024 |
Eligible student complained that the School District improperly disclosed their Personally Identifiable Information when it posted a graduation photograph of the student submitted by the student’s parent. |
|
|
7/19/2024 |
Parent complained that the school district improperly disclosed other students’ personally identifiable information to her. |
|
|
6/26/2024 |
Parents complained that, in response to a FERPA request for the educational records of their children, the School District inappropriately left their children’s information in an unsecure location causing a breach. |
|
|
4/30/2024 |
Parent complained that the school improperly disclosed their child’s PII when it posted the child’s name and test scores on a bulletin board located in a hallway of the school. |
|
|
Success Academy Charter School - Rockaway Park Middle School |
3/8/2024 |
At the request of Success Academy, the Privacy Office reviewed its December 21, 2023 determination and issued a revised determination addressing the educational agency’s parent consent form. |
|
2/27/2024 |
Parent complained that in response to a request for her child’s test scores she received the test scores and other reports of all the students in her child’s class. In another incident, parent complains that the school shared her child’s information with individuals who are not school officials. |
|
|
Success Academy Charter School - Rockaway Park Middle School Determination |
12/21/2023 |
Parent complained that the school improperly disclosed her child’s personally identifiable information when it posted student grade point averages (GPAs) in a manner visible to everyone entering her child’s classroom. |
|
12/13/2023 |
Parent complained that the school district improperly disclosed her child’s personally identifiable information when the transportation department was notified that the student did not need to be picked up for several days because the student was suspended due to a disciplinary matter. |
|
|
12/1/2023 |
Parent complained that although they “opted-out” of posting their children’s pictures, the school district published a picture of the freshman year class which included the parent’s child. |
|
|
12/1/2023 |
Complainant alleged that The District failed to provide her with access to the Student’s educational and health records and that the District disclosed PII concerning the student to a third-party entity without consent. |
|
|
11/7/2023 |
Parent complained that they received a child’s 504 plan in the mail, who is not the complainant’s child and that the school district was unresponsive when parent reached out. |
|
|
8/24/2023 |
Parent complained that the District without obtaining permission, provided the cell phone numbers for families whose children had been identified as potential participants in the My Brothers Keeper (MBK) program to the program coordinator. The program coordinator used the phone numbers to create a group text to communicate with the families. |
|
|
8/16/2023 |
Parent complained that a District employee improperly disclosed student PII to the student’s emergency contact who is not the student’s parent or legal guardian. |
|
|
8/16/2023 |
Parent complained that a District employee inappropriately shared student PII (after school pick-up) with the parent’s former spouse. |
|
|
8/4/2023 |
Parent complained that the Superintendent unnecessarily included irrelevant student PII in an email to the parent which copied all members of the school board. |
|
|
7/13/2023 |
Two school districts filed incident reports indicating that a former employee of Behavioral Strategies had inappropriately accessed student data through her Behavioral Strategies account after she left her employment with Behavioral Strategies. |
|
|
5/17/2023 |
Parent complained that a District employee accessed their child’s education record in order to enable a former employee of the district to mail personal correspondence to the parent’s home. |
|
|
4/7/2023 |
Parent complained that reports made via the District’s Dignity for All Students Act (“DASA”) reporting form were accessible to all district students to read. |
|
|
3/28/2023 |
Complainant alleged that former staff members of the Dr. Richard Izquierdo Health & Science Charter School obtained student Personally Identifiable Information (“PII”) before leaving and used that information to recruit students for their new employer, the Charter High School for Law and Social Justice. |
|
|
3/17/2023 |
Parent complained, after receiving a text message about their child’s vaccination status, that the Infinite Campus data protection agreement did not comply with Education Law §2-d. |
|
|
7/28/2022 |
Parent complained that the school district improperly allowed another parent to view video of an incident that involved 5 students, including complainant’s child. |
|
|
7/13/2022 |
Parent complained that their child’s PII was implicitly disclosed when select students were rewarded with ice cream for exhibiting growth in a reading assessment and other students were not. |
|
|
7/5/2022 |
Parent complained that their child’s PII was released by a teacher posting information on an educational website and on Twitter. |
|
|
4/29/2022 |
Whether a school district, upon learning of an unauthorized disclosure of student personally identifiable information, provided adequate notification of the unauthorized disclosure to the parents of affected students. |
|
|
12/1/2021 |
Complainant alleged that the school district disclosed student and family PII — specifically, names, addresses, and phone numbers—without consent, to the president of the teacher’s union. |
|
|
11/30/2021 |
Complainant alleged that the school district improperly displayed students’ names and pronouns, which might indicate a student’s gender identity, on a school hallway without first obtaining consent. |
|
|
11/30/2021 |
Parent complained that the school district failed to provide the Parent with access to student’s education records; the school district disclosed PII to third-party service providers and the school district disclosed student PII, without consent to employees who did not have a reason to know the PII. |