DOE privacy officer explains data sharing under FERPA school officials exception

How are we handling the issue of parental consent when it comes to the sharing of data?

Thank you for that question.

I am going to ask Dennis Doyle to come up while I speak.

So, you know, we...

The idea of parental consent and the use of tools and tools that schools have selected for an instructional purpose, we have not had a consent process in place for.

And that was a lot of the feedback, too.

My kid is engaging with generative AI, and I don't want it.

Can I opt out of it?

And that was some of the feedback that we took into consideration and even led us to the moratorium of it, especially for our youngest.

As it relates to the safety guardrails around student privacy and communicating that, I'm going to turn it over to Dennis to share some of our processes.

Thank you, First Deputy Chancellor, and thank you everyone for the question and for inviting us to be here today.

My name is Dennis Doyle.

I'm the Chief Privacy Officer for New York City Public Schools.

Obviously, protecting student data privacy is of our utmost priority, particularly from my office.

And whenever we have any third-party vendor that we use in a way that they're going to be accessing student information, we make sure that they go through a very rigorous data privacy and compliance process.

We call it IRMA by shorthand.

But basically what that process means is that those third-party vendors have to enter into a data processing agreement that requires them to keep data confidential, secure, that they only use it for the required purpose, data minimization,

et cetera.

And then there's also a data security review that our DIT team conducts, and also a separate review conducted by the New York City Office of Technology and Innovation.

With respect to consent, there's no consent collected from parents or students in order to share that data with those third-party contractors.

We rely on a specific exception under FERPA, which is known as the school officials exception, which permits schools to share student data with third-party contractors, provided that we're

We have direct control over the use and maintenance of that information, and we do that by having strong contractual agreements in place with all these vendors to make sure that our data is being kept confidential and secure.