Determinations of the Chief Privacy Officer

Parent complained that their child’s PII was released by a teacher posting information on an educational website and on Twitter.

Two school districts filed incident reports indicating that a former employee of Behavioral Strategies had inappropriately accessed student data through her Behavioral Strategies account after she left her employment with Behavioral Strategies.

Parent complained that a District employee accessed their child’s education record in order to enable a former employee of the district to mail personal correspondence to the parent’s home.

Parent complained that they received a child’s 504 plan in the mail, who is not the complainant’s child and that the school district was unresponsive when parent reached out.

Parent complained that although they “opted-out” of posting their children’s pictures, the school district published a picture of the freshman year class which included the parent’s child.

Eligible student complained that the School District improperly disclosed their Personally Identifiable Information when it posted a graduation photograph of the student submitted by the student’s parent.

Parent complained that the School District posted pictures of their child on social media without consent in violation of FERPA and Education Law § 2-d.

Parents complained that, in response to a FERPA request for the educational records of their children, the School District inappropriately left their children’s information in an unsecure location causing a breach.

Parent complained, after receiving a text message about their child’s vaccination status, that the Infinite Campus data protection agreement did not comply with Education Law §2-d.

Parent complained that the school district improperly allowed another parent to view video of an incident that involved 5 students, including complainant’s child.

Parent complained that the school district failed to provide the Parent with access to student’s education records; the school district disclosed PII to third-party service providers and the school district disclosed student PII, without consent to employees who did not have a reason to know the PII.

Parent complained that the school improperly disclosed their child’s PII when it posted the child’s name and test scores on a bulletin board located in a hallway of the school.

Parent complained that the school improperly disclosed her child’s personally identifiable information when it posted student grade point averages (GPAs) in a manner visible to everyone entering her child’s classroom.

At the request of Success Academy, the Privacy Office reviewed its December 21, 2023 determination and issued a revised determination addressing the educational agency’s parent consent form.

Parent complained that their child’s PII was implicitly disclosed when select students were rewarded with ice cream for exhibiting growth in a reading assessment and other students were not.

Parent complained that the school district improperly disclosed her child’s personally identifiable information when the transportation department was notified that the student did not need to be picked up for several days because the student was suspended due to a disciplinary matter.