SECTION I - Policy No 22 - Information Security Breach and Notification

View a printable PDF version

The school district values the protection of private information of individuals in accordance with applicable law and regulations. Further, the district is required to notify affected individuals when there has been or is reasonably believed to have been a compromise of the individual’s private information in compliance with the Information Security Breach and Notification Act and Board policy.

‘Private information’ shall mean **personal information in combination with any one or more of the following data elements when either the personal information or the data element is not encrypted or encrypted with an encryption key that has also been acquired:

Social security number;
Driver’s license number or non-driver identification card number; or
Account number, credit or debit card number in combination with any required security code, access code or password which would permit to an individual’s financial account.

‘Private information’ does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.

**’Personal information’ shall mean any information concerning a person which because of name, number, symbol, mark or other identifier can be used to identify that person.

‘Breach of the security of the system’ shall mean unauthorized acquisition or acquisition without valid authorization of computerized data which compromises the security, confidentiality or integrity of personal information maintained by the district. Good faith acquisition of personal information by an employee or agent of the district for the purposes of the district is not a breach of the security of the system provided that private information is not used or subject to unauthorized disclosure.

Examples of Determining Factors

In determining whether information has been acquired or is reasonably believed to have been acquired by an unauthorized person or person without valid authorization, the district may consider the following factors among others:

Indications that the information is in the physical possession and control of an unauthorized person such as a lost or stolen computer or other device containing information; or
Indications that the information has been downloaded or copied; or
Indications that the information was used by an unauthorized person such as fraudulent accounts opened or instances of identity theft reported.

Notification Requirements

For any computerized data owned or licensed by the school district that includes private information, the district shall disclose any breach of the security of the system following discovery or notification of the breach to any New York State resident whose private information was or is reasonably believed to have been acquired by a person without valid authorization. The disclosure to affected individuals shall be made in the most expedient time possible and without unreasonable delay consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. The district shall consult with the State Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) to determine the scope of the breach and restoration measures.
For any computerized data maintained by the district that includes private information which the district does not own, the district shall notify the owner or licensee of the information of any breach of the security of the system immediately following discovery if the private information was or is reasonably believed to have been acquired by a person without valid authorization.

The notification requirement may be delayed if a law enforcement agency determines that notification impedes a criminal investigation. The required notification shall be made after the law enforcement agency determines that such notification does not compromise the investigation.

Methods of Notification

The required notice shall be directly provided to the affected persons by one of the following methods:

Written notice;
Electronic notice provided that the person to whom notice is required has expressly consented to receiving the notice in electronic form and a log of each such notification is kept by the district when notifying affected persons in electronic form. However, in no case shall the district require a person to consent to accepting such notice in electronic form as a condition of establishing any business relationship or engaging in any transaction;
Telephone notification provided that a log of each such notification is kept by the district when notifying affected persons by phone; or
Substitute notice if the district demonstrates to the State Attorney General that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds $500,000, or that the district does not have sufficient contact information.

1)Email notice when the district has an email address for the subject persons; 2)Conspicuous posting of the notice on the district’s website page if the district maintains one; and 3)Notification to major statewide media.

Regardless of the method by which notice is provided the notice shall include contact information for the notifying district and a description of the categories of information that were or are reasonably believed to have been acquired by a person without valid authorization including specification of which of the elements of personal information and private information we are reasonably believed to have been so acquired.

In the event that any New York State residents are to be notified, the district shall notify the State Attorney General, the Consumer Protection Board, and the State Office of Cyber Security and Critical Infrastructure Coordination as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York State residents.

In the event that more than five thousand (5,000) New York State residents are to be notified at one time, the district shall also notify consumer reporting agencies as defined pursuant to State Technology Law Section 208 as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice shall be made without delaying notice to affected New York State residents. A list of consumer reporting agencies shall be compiled by the State Attorney General and furnished upon request to school districts required to make a notification in accordance with State Technology Law Section 208(2), regarding notification of breach of security of the system for any computerized data owned or licensed by the district that includes private information.

State Technology Law Sections 202 and 208

Chenango Valley

Central School District