Senate Bill S3934

                                BILL NUMBER:S3934

TITLE OF BILL:

An act to repeal paragraph d of subdivision 2 of section 2-d of the
education law, relating to certain provisions relating to the chief
privacy officer

PURPOSE:

To repeal the requirement that a Chief Privacy Officer may hold more
than one position at the State Education Department.

SUMMARY OF PROVISIONS:

Section 1: Section 1 repeals paragraph d of subdivision 2 of section
2-d of the education law.

Section 2: Section 2 sets forth an immediate effective date.

EXISTING LAW:

Current law allows for a Chief Privacy Officer to hold more than one
position within the State Education Department.

JUSTIFICATION:
              

The 2014-2015 Enacted Budget included comprehensive student data and
privacy legislation to ensure an appropriate balance between necessary
data being used in a responsible way by educators and schools and the
protection of such elements of that data that relate to the personal
identifiers of students and teachers. One of the most critical aspects
of the legislation was to establish a Chief Privacy Officer (CPO)
within the State Education Department (SED). The CPO would be in
charge of ensuring that appropriate balance is maintained throughout
the State by establishing a Parents Bill of Rights for Data Privacy
and Security and being a contact person for the public to get
information and report incidents of possible malfeasance or a data
breach, among other responsibilities.

The legislation as enacted was intended to allow SED flexibility in
hiring a CPO from within the department, if that is what SED chose to
do, by stating that the CPO "may" hold more than one position within
the department. It was not the intent of the legislation to state
conclusively that the CPO "must" be hired from within SED and that he
or she "must" hold more than one position within the department.
Unfortunately, it has been interpreted by the Division of Budget (DOB)
that the language as enacted created a "part-time" position at SED,
when in fact it should be a full time position. The enacted
legislation set forth stringent hiring criteria that required the CPO
to be, among other things, intimately knowledgeable about information
systems and the educational system in the State. All told the
requirements of being the CPO and the responsibilities that the CPO is
to undertake are that of a full time position within SED.

SED has yet to fill the position of CPO, primarily because it has been
determined by DOB to be a part time position, when in fact it is not.


By repealing this paragraph, it will clarify that the position is
indeed a full time position and will significantly help SED hire a
CPO. To ensure our students' and teachers' personal data is protected,
it is imperative that a CPO be hired as expeditiously as possible.
This legislation will ensure that happens.

LEGISLATIVE HISTORY:

2015: New bill.

FISCAL IMPLICATIONS:

No new fiscal implication. This legislation would help the State
Education Department hire an appropriately qualified Chief Privacy
Officer.

EFFECTIVE DATE:

This act shall take effect immediately.