Purpose

The purpose of this policy is to state what constitutes the acceptable technology device usage and what constitutes the misuse of SANY IT Resources.

Accountability

Under the direction of the District Superintendent or his/her designee shall ensure compliance with this policy. The Operations Managers, Deans, and other members of management will implement this policy in their respective areas.

Applicability

This policy applies to all members of the SANY Community who access and use the SANY's electronic information and information systems.

Definitions

Refer to the Technology Terms and Definitions for terms and definitions that are used in this policy.

Policy

1. Computer accounts and network access is provided for exclusive use by an individual or a group of individuals specified by SANY. Providing other individuals or groups access to your account or use of the district network is not allowed.
2. Attempts to gain unauthorized access to any account, file or network which is not specifically provided for your use, including those systems not operated by SANY is forbidden and WILL result in immediate revocation of ALL accounts and network access provided for your use by SANY.
3. Attempts to circumvent restrictions placed on your account or network access are forbidden.
4. Computer services or network access at SANY are not allowed to be used for commercial purposes other than those that are involved in the running of the district.
5. Incidental use of technology devices for personal, non-work-related purposes is acceptable. However, personal use must be infrequent during staff's free time and must not:
   1. Involve any prohibited activity
   2. Interfere with the productivity of the employee or his/her coworkers
   3. Consume system resources or storage capacity on an ongoing basis
   4. Involve large file transfers or otherwise deplete system resources.
   5. Result in a negative impact on district related uses.
6. District network services, equipment, wiring or jacks may not be altered, removed or extended beyond the location of their intended use.
7. SANY network resources may not be retransmitted outside of the SANY community. Examples include, but are NOT limited to: district licensed software.
8. The district network is a shared resource. Excessive use of the network resources which inhibits or interferes with the use of the network by others is not permitted.
9. District network resources may not be used to defame, harass, intimidate or threaten. 
10. Use of SANY's computer services or network access for ILLEGAL purposes are expressly forbidden. Violations of any of the rules and regulations listed above can result in the suspension and/or revocation of any and/or all computer accounts and network access provided to you by SANY. Violations of district regulations or local, state and federal law will be referred to the appropriate authorities.
11. SANY reserves the right to inspect any information or data residing on any of its systems whenever it is deemed necessary. All information, including personal information, placed on district systems or sent over the district network may be monitored. Use of SANY's computer and network systems, authorized or unauthorized, constitutes consent to monitoring of these systems.

Policy Compliance

IT resources, computer accounts, and network access is provided to students, faculty and staff of SANY as a privilege. The SANY, including district office and schools, reserves the right to terminate any user’s access to SANY IT resources, computer accounts, and network access at any time.

Suspected violations of this policy by a student must be immediately reported to the school Dean or his/her designee. The school Dean or his/her designee, will, in turn, notify the student’s parent(s) and review the facts of the incident with them. After giving the student an opportunity to be heard and reviewing the details of the case, consistent with the school Code of Conduct, the school Dean will determine an appropriate penalty.  If inappropriate student conduct has occurred, the student’s account may be closed for a designated period of time, and disciplinary action ranging from loss of Internet access privileges to suspension from school may be taken. Based upon all the facts and in the discretion of the school Dean or his/her designee, the school Dean will determine the final action to be taken. School will notify appropriate governmental or law enforcement agencies of any violation of this Policy, as required by law.

Suspected violations of the policy by a staff member should also be reported to the school Dean, who will review the facts of the incident and after giving all parties an opportunity to be heard, shall determine whether disciplinary action is required. If such action is appropriate, the user’s account may be closed for a designated period of time, as determined by the school Dean, and disciplinary action may be taken in accordance with the applicable Board Policies and school regulations and the terms of the employee’s employment agreement. Based on all the facts and the school Dean’s discretion, the school Dean will determine the final action to be taken. School will notify appropriate governmental or law enforcement agencies of any violation of this Policy, as required by law. 

Access to the internet, email or a computer account may also be revoked by the school for any established violation of a policy, rule or regulation of school. 

All users must promptly disclose to their teacher, supervisor, dean of school or operations manager any information they receive that is inappropriate or makes them feel uncomfortable.

Limitation of Liability

The SANY makes no guarantees about the quality of the services provided and is not responsible for any claims, losses, damages, costs, or other obligations arising from use of the network or accounts. Any additional charges a user accrues due to the use of the SANY’s network are to be borne by the user. The SANY also denies any responsibility for the accuracy or quality of the information obtained through user access. Any statement, accessible on the computer network or the Internet, is understood to be the author's individual point of view and not that of the SANY, its affiliates, or employees.

Parents (includes legal guardians or persons in parental relationships) and Eligible Students (student 18 years and older) can expect the following:

1. A student’s personally identifiable information (PII) cannot be sold or released for any commercial purpose. PII, as defined by Education Law § 2-d and FERPA, includes direct identifiers such as a student’s name or identification number, parent’s name, or address; and indirect identifiers such as a student’s date of birth, which when linked to or combined with other information can be used to distinguish or trace a student’s identity. Please see FERPA’s regulations at 34 CFR 99.3 for a more complete definition.
   
   
2. The right to inspect and review the complete contents of the student’s education record stored or maintained by an educational agency. This right may not apply to parents of an Eligible Student.
   
   
3. State and federal laws such as Education Law § 2-d; the Commissioner of Education’s Regulations at 8 NYCRR Part 121, the Family Educational Rights and Privacy Act ("FERPA") at 12 U.S.C. 1232g (34 CFR Part 99); Children's Online Privacy Protection Act ("COPPA") at 15 U.S.C. 6501-6502 (16 CFR Part 312); Protection of Pupil Rights Amendment ("PPRA") at 20 U.S.C. 1232h (34 CFR Part 98); the Individuals with Disabilities Education Act (“IDEA”) at 20 U.S.C. 1400 et seq. (34 CFR Part 300); protect the confidentiality of a student’s identifiable information.
   
   
4. Safeguards associated with industry standards and best practices including but not limited to encryption, firewalls and password protection must be in place when student PII is stored or transferred.
   
   
5. A complete list of all student data elements collected by NYSED is available at https://www.nysed.gov/data-privacy-security/student-data-inventory and by writing to: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234.
   
   
6. The right to have complaints about possible breaches and unauthorized disclosures of PII addressed. Complaints may be submitted to NYSED at https://www.nysed.gov/data-privacy-security/report-improper-disclosure, by mail to: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234; by email to This email address is being protected from spambots. You need JavaScript enabled to view it.; or by telephone at 518-474- 0937.
   
   You may also submit a complaint to the District, by mail to: Data Protection Officer, Science Academies of New York Charter Schools, 1409 W Genesee St. Syracuse, NY 13204; by email to This email address is being protected from spambots. You need JavaScript enabled to view it.; or by telephone at 315-671-5470.
   
   
7. To be notified in accordance with applicable laws and regulations if a breach or unauthorized release of PII occurs.
   
   
8. Educational agency workers that handle PII will receive training on applicable state and federal laws, policies, and safeguards associated with industry standards and best practices that protect PII.
   
   
9. Educational agency contracts with vendors that receive PII will address statutory and regulatory data privacy and security requirements.

Purpose 

This policy sets forth the acceptable uses regarding the access and use of SANY's electronic information and information systems.

Accountability

Under the direction of the District Superintendent or his/her designee shall ensure compliance with this policy. The Operations Managers, Deans, and other members of management will implement this policy in their respective areas.

Applicability

This policy applies to all members of the SANY who access and use the SANY's electronic information and information systems.

Definitions

Refer to the Technology Terms and Definitions for terms and definitions that are used in this policy.

Policy

1. The SANY expects users will access and use the SANY's electronic information and information systems in a manner that:
   1. Does not compromise the confidentiality, integrity, or availability of those assets; and
   2. Reflects the SANY 's standards as defined in the Code of Conduct/Statement of Principles and its body of policies, and in accordance with all applicable federal, state, and local laws governing the use of computers and the Internet.
2. These obligations apply regardless of where access and use originate: SANY office, classroom, public space, lab, at home, or elsewhere outside the SANY.
3. The rules stated in this policy also govern the use of information assets provided by the State of New York, other state and federal agencies, and other entities that have contracted with SANY to provide services to their constituents and/or clients.
4. This policy and SANY's Code of Conduct also govern access and use of the SANY's electronic information and information systems originating from non-SANY computers, including personal computers and other electronic devices. The access and use of electronic information provided by funding partners to SANY are also governed by this policy.
5. The use of information systems acquired or created through the use of SANY funds, including grant funds from contracts between the SANY and external funding sources (public and private), are covered by this policy. This includes SANY information systems that are leased or licensed for use by members of the SANY Community. Users are given access to SANY's electronic information and information systems specifically to assist them in the performance of their jobs and education. They are not provided for personal use. They are responsible for all activity conducted using their computer accounts. Access and use of the SANY's electronic information and information systems is a revocable privilege.
6. SANY recognizes that all members of the SANY Community have an expectation of privacy for information in which they have a substantial personal interest. However, this expectation is limited by SANY's need to comply with applicable laws, protect the integrity of its resources, and protect the rights of all users and the property and operations of SANY. As such, SANY reserves the right to access, quarantine, or hold for further review any files or computing devices on SANY's network or its information technology resources if there is just cause to believe that SANY policies or laws are being violated or if such access is necessary to comply with applicable law or conduct SANY business operations.
7. Information created, stored, or accessed using SANY information systems may be accessed and reviewed by SANY personnel for legitimate systems purposes, including but not limited to the following:
   1. Emergency Problem Resolution
   2. To measure, monitor, and address the use, performance, or health of the SANY's information systems, or to respond to information security issues. Internet usage may also be monitored when using the SANY's network.
   3. To create data backups of electronic information stored on SANY's information systems.
   4. To respond to User Requests approved by the district office.
8. Information may be accessed, reviewed, and provided to an external party at the SANY's discretion without prior notification with adequate cause and subject to review of the district office to comply with applicable law and to conduct normal SANY operations. Examples include, but are not limited to the following:
   1. Compliance with the New York Freedom of Information Law ("FOIL") which requires disclosure of electronic records and other data on the SANY system subject to exemptions under FOIL. Requests will be reviewed by the Operations Managers in conjunction with the district office.
   2. Compliance with a valid subpoena, court order, or discovery request. Requests will be reviewed by the district office.
   3. Audits, investigations, or inquiries undertaken by governmental entities or appropriate internal investigators or units. Requests will be reviewed by the district office.
   4. To conduct necessary business operations.
9. All electronic information created, stored, or transmitted by use of SANY's information systems is the property of the SANY, unless otherwise explicitly noted.
10. IT Managers and IT Technicians have greater ability to access information stored on and transmitted through SANY's information systems. As such, IT Managers, IT Technicians, and others with privileged access shall not access such information unless such access is necessary for the purposes outlined above, for systems purposes, or unless such access is supported by adequate cause and reviewed by the district office.
11. Prohibited Actions
    1. The list of prohibited actions is not intended to be comprehensive. The evolution of technology precludes the SANY from anticipating all potential means of capturing and transmitting information. Therefore, users must take care when handling sensitive information. 
    2. Users, at minimum, will ensure that they do not:
       1. Distribute information classified as Confidential or Private, or otherwise considered or treated as privileged or sensitive information, unless they are an authoritative SANY source for, and an authorized SANY distributor of that information and the recipient is authorized to receive that information.
       2. Share their passwords with other individuals or institutions (regardless if they are affiliated with SANY or not) or otherwise leave them unprotected.
       3. Attempt to uninstall, bypass, or disable security settings or software protecting the SANY's electronic information, information systems, or computer hardware.
       4. Engage in unauthorized attempts to gain access or use the SANY's electronic information, information systems, or another user's account. Users with privileged access, such as IT Managers and Technicians, shall not engage in unauthorized access, use, or review of information or data, without appropriate approvals.
       5. Use third-party email services to conduct sensitive SANY business or to send or receive SANY information classified as Confidential, Private or Internal or otherwise considered privileged or sensitive information.
       6. Use email auto-forwarding to send SANY information (regardless of classification) to non-SANY email accounts (see #12 Restricted Services).
       7. Distribute or collect copyrighted material without the expressed and written consent of the copyright owner or without lawful right to do so, such as in the case of fair use.
       8. User understands the FERPA Privacy Security rules, especially with regard to Sensitive Electronic Information (SEI), Private Health Information (PHI), and Personally Identifiable Information (PII) and will abide by these rules, including understanding that they will be held accountable for the use of personal devices for conducting SANY business.
12. Restricted Services
    1. This list of restricted services is not intended to be comprehensive. The evolution of technology precludes the SANY from anticipating all potential means of storing, capturing and transmitting information. Therefore, when using third-party technology services not explicitly restricted in this policy, users must exercise care to not compromise sensitive SANY information, particularly when confirmation of receipt or the identity of the recipient is required for business or legal purposes. 
    2. Restricted services include the following:
       1. Social Media
          1. Social media tools or web content platforms cannot be used to communicate or store SANY information classified as Confidential or Private or otherwise considered privileged or sensitive by SANY. Social media tools include, but are not limited to: Facebook, Twitter, LinkedIn, Instagram, Medium, Reddit, YouTube and Flickr.
          2. For additional requirements on the use of social media, see the Social Media Policy.
       2. Professional Social Media
          1. Professional social media cannot be used to communicate or store SANY information classified as Confidential or Private or otherwise considered privileged or sensitive by SANY.
       3. Cloud Services, Collaboration and Storage
          1. Third-party cloud storage services cannot be used to store SANY information classified as Confidential.
          2. Google Drive is approved for Private, Internal and Public data.
          3. The use of non-approved third-party cloud storage services cannot be used to store SANY information classified as Confidential or Private or otherwise considered privileged or sensitive by SANY. Cloud storage tools include, but are not limited to: iCloud, Carbonite, OneDrive, Box, Dropbox, Evernote, OpenDrive and SugarSync.
       4. Third Party Email Services
          1. Third party email services cannot be used to communicate or store SANY information classified as Confidential or Private or otherwise considered privileged or sensitive.
       5. Email Auto-Forwarding
          1. Faculty, staff and medical students are not permitted to automatically forward or redirect messages from their primary email address to a non-SANY email address.
       6. Texting
          1. Texting cannot be used to communicate or store SANY information classified as Confidential.
       7. Video Conferencing
          1. Video conferencing services are limited to SANY business-use only and must be conducted using SANY equipment. They are to be used strictly for business collaboration between members of the SANY Community or outside entities, or for educational purposes. Users must ensure that video communications are done in a setting or configured to restrict the possibility of non-authorized individuals from viewing or listening to sensitive information.
       8. Chat
          1. The use of non-approved chat services cannot be used to communicate or store SANY information classified as Confidential or Private or otherwise considered privileged or sensitive by SANY. Chat tools include, but are not limited to: Slack and HipChat.
       9. BitTorrent Software
          1. BitTorrent software (or other file sharing software) used to download and share movies, music, and other copyrighted media is strictly forbidden unless it is used for SANY business or academic purposes. The use of this software must be approved by the Director of Information and Instructional Technologies.

Policy Compliance

IT resources, computer accounts, and network access is provided to students, faculty and staff of SANY as a privilege. The SANY, including district office and schools, reserves the right to terminate any user’s access to SANY IT resources, computer accounts, and network access at any time.

Suspected violations of this policy by a student must be immediately reported to the school Dean or his/her designee. The school Dean or his/her designee, will, in turn, notify the student’s parent(s) and review the facts of the incident with them. After giving the student an opportunity to be heard and reviewing the details of the case, consistent with the school Code of Conduct, the school Dean will determine an appropriate penalty.  If inappropriate student conduct has occurred, the student’s account may be closed for a designated period of time, and disciplinary action ranging from loss of Internet access privileges to suspension from school may be taken. Based upon all the facts and in the discretion of the school Dean or his/her designee, the school Dean will determine the final action to be taken. School will notify appropriate governmental or law enforcement agencies of any violation of this Policy, as required by law.

Suspected violations of the policy by a staff member should also be reported to the school Dean, who will review the facts of the incident and after giving all parties an opportunity to be heard, shall determine whether disciplinary action is required. If such action is appropriate, the user’s account may be closed for a designated period of time, as determined by the school Dean, and disciplinary action may be taken in accordance with the applicable Board Policies and school regulations and the terms of the employee’s employment agreement. Based on all the facts and the school Dean’s discretion, the school Dean will determine the final action to be taken. School will notify appropriate governmental or law enforcement agencies of any violation of this Policy, as required by law. 

Access to the internet, email or a computer account may also be revoked by the school for any established violation of a policy, rule or regulation of school. 

All users must promptly disclose to their teacher, supervisor, dean of school or operations manager any information they receive that is inappropriate or makes them feel uncomfortable.

Limitation of Liability

The SANY makes no guarantees about the quality of the services provided and is not responsible for any claims, losses, damages, costs, or other obligations arising from use of the network or accounts. Any additional charges a user accrues due to the use of the SANY’s network are to be borne by the user. The SANY also denies any responsibility for the accuracy or quality of the information obtained through user access. Any statement, accessible on the computer network or the Internet, is understood to be the author's individual point of view and not that of the SANY, its affiliates, or employees.

Policy Statement:

In alignment with the mandates of New York State Education Law §2-d, the District underscores its commitment to implement the requirements delineated in Commissioner’s regulations (8 NYCRR §121). Furthermore, the District places a high priority on safeguarding data security and privacy by adhering to the stringent standards set forth in the National Institute for Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity Version 1.1 (commonly referred to as the "NIST Cybersecurity Framework" or "NIST CSF"). The Director of Informational & Instructional Technology is entrusted with the responsibility of ensuring the district’s systems are in compliance with the NIST CSF and incorporate technologies, safeguards, and practices that align with this framework.

This comprehensive approach encompasses an assessment of the district’s current cybersecurity state, the establishment of a target future cybersecurity state, identification of opportunities for improvement, tracking progress toward the target state, and effective communication regarding the risks associated with cybersecurity. To oversee the effective implementation of these policies and procedures, the Superintendent will appoint a Privacy and Security Officer, who will also serve as the primary point of contact for data security and privacy within the district.

Use and Disclosure of Personally Identifiable Information (PII):

In adherence to these policies, each instance of using and disclosing personally identifiable information (PII) by the District is directed towards advancing the welfare of students and the District itself. These objectives may include enhancing academic achievement, empowering parents and students with essential information, and optimizing the efficiency and effectiveness of school operations. It is noteworthy that PII shall not be included in public reports or other documents.

The District reaffirms its unwavering commitment to protect the confidentiality of PII by strictly refraining from selling PII, disclosing it for marketing or commercial purposes, facilitating its use or disclosure for any such purposes by third parties, or permitting the same. Additionally, proactive measures will be taken to minimize the collection, processing, and transmission of PII.

The District will ensure that all contracts entered into with third-party contractors reflect the imperative of maintaining the confidentiality of student, teacher, or principal PII in strict accordance with federal and state law, as well as the district's data security and privacy policy.

Compliance with Federal Regulations:

In addition to the above, the District demonstrates full compliance with the regulations set forth in the Family Educational Rights and Privacy Act of 1974 (FERPA). In line with FERPA’s strict stipulations, the District will only release PII contained in student education records when it has received explicit written consent (signed and dated) from a parent or eligible student. Detailed information can be found in Board of Education policy no. 5500 and any pertinent administrative regulations.

Moreover, in acknowledgment of the additional privacy protections afforded by the Individuals with Disabilities Education Act (IDEA) to students receiving special education and related services, the District will keep parents informed of the necessity and timeline for retaining information. Permanent record information, excepted, shall be destroyed upon parental request. The District will diligently adhere to all these privacy provisions, thereby ensuring the confidentiality of PII throughout the collection, storage, disclosure, and destruction stages, as per federal regulations 34 CFR 300.610 through 300.627.

Third-party Contractors:

The district will ensure that contracts with third-party contractors reflect that confidentiality of any student and/or teacher or principal PII be maintained in accordance with federal and state law and the district's data security and privacy policy.   
Each third-party contractor that will receive student data or teacher or principal data must:

1. adopt technologies, safeguards and practices that align with the NIST CSF;
2. comply with the district’s data security and privacy policy and applicable laws impacting the district;
3. limit internal access to PII to only those employees or sub-contractors that need access to provide the contracted services;
4. not use the PII for any purpose not explicitly authorized in its contract;
5. not disclose any PII to any other party without the prior written consent of the parent or eligible student (i.e., students who are eighteen years old or older):
   1. except for authorized representatives of the third-party contractor to the extent they are carrying out the contract; or
   2. unless required by statute or court order and the third-party contractor provides notice of disclosure to the district, unless expressly prohibited.  
6. maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of PII in its custody;
7. use encryption to protect PII in its custody; and
8. not sell, use, or disclose PII for any marketing or commercial purpose, facilitate its use or disclosure by others for marketing or commercial purpose, or permit another party to do so. Third party contractors may release PII to subcontractors engaged to perform the contractor’s obligations, but such subcontractors must abide by data protection obligations of state and federal law, and the contract with the district.

If the third-party contractor has a breach or unauthorized release of PII, it will promptly notify the district in the most expedient way possible without unreasonable delay but no more than seven calendar days after the breach’s discovery.

Third-Party Contractors’ Data Security and Privacy Plan:

The district will ensure that contracts with all third-party contractors include the third-party contractor’s data security and privacy plan. This plan must be accepted by the district.  

At a minimum, each plan will:  

1. outline how all state, federal, and local data security and privacy contract requirements over the life of the contract will be met, consistent with this policy;
2. specify the safeguards and practices it has in place to protect PII;
3. demonstrate that it complies with the requirements of Section 121.3(c) of this Part;
4. specify how those who have access to student and/or teacher or principal data receive or will receive training on the federal and state laws governing confidentiality of such data prior to receiving access;
5. specify if the third-party contractor will utilize sub-contractors and how it will manage those relationships and contracts to ensure personally identifiable information is protected;
6. specify how the third-party contractor will manage data security and privacy incidents that implicate personally identifiable information including specifying any plans to identify breaches and unauthorized disclosures, and to promptly notify the district;
7. describe if, how and when data will be returned to the district, transitioned to a successor contractor, at the district’s direction, deleted or destroyed by the third-party contractor when the contract is terminated or expires.

Training:

The District acknowledges the paramount importance of enhancing awareness and understanding of data privacy and security among its employees. Accordingly, annual training on data privacy and security awareness will be provided to all employees who have access to student, teacher, or principal PII.

Complaint Procedures:

The Superintendent, or their duly appointed designee, will undertake the establishment and dissemination of comprehensive procedures that facilitate the submission of complaints by parents, eligible students, and employees in the event of breaches or unauthorized releases of student, teacher, or principal data, as stipulated in 8 NYCRR §121.4. The Superintendent is further vested with the authority to promulgate any and all additional regulations that are deemed necessary and appropriate for the full implementation of this policy.

Notifications:

The Privacy and Security Officer shall act promptly in reporting any discovery or report of a breach or unauthorized release of student, teacher, or principal PII to the State’s Chief Privacy Officer. This report shall be made without undue delay, but in no case more than 10 calendar days after the discovery. Furthermore, the District commits to notifying affected parents, eligible students, teachers, and/or principals in the most expeditious manner, without unreasonable delay, but in no case more than 60 calendar days after the discovery of a breach or unauthorized release or third-party contractor notification. However, it is imperative to note that in circumstances where notification may interfere with an ongoing law enforcement investigation or lead to further disclosure of PII by exposing an unfixed security vulnerability, the district shall notify parents, eligible students, teachers, and/or principals within seven calendar days after the security vulnerability has been remedied, or when the risk of interference with the law enforcement investigation ceases. To facilitate this process, the Superintendent, in consultation with the Privacy and Security Officer, shall establish procedures for notifying affected parties of a breach or unauthorized release of student, teacher, or principal PII, and communicate to parents, eligible students, and district staff a process for filing complaints about breaches or unauthorized releases of such information.

References:

• Education Law §2-d
• 8 NYCRR §121
• Family Educational Rights and Privacy Act of 1974, 20 USC §1232(g), 34 CFR 99
• Individuals with Disabilities Education Act (IDEA), 20 USC §1400 et seq., 34 CFR 300.610–300.627