A. The Board of Education of the North Colonie Central School District values the protection of private information of individuals. The North Colonie Central School District is required to notify an individual when there has been or is reasonably believed to have been a compromise of the individual’s private information in compliance with the Information Security Breach and Notification Act and this policy. This policy is consistent with the State Technology Law, section 208 as added by Chapters 442 and 491 of the laws of 2005.
B. The North Colonie Central School District, after consulting with the New York State Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) to determine the scope of the breach and restoration measures, shall notify an individual when it has been determined that there has been, or is reasonably believed to have been a compromise of private information through unauthorized disclosure.
C. A compromise of private information shall mean the unauthorized acquisition of unencrypted computerized data with private information.
D. If encrypted data is compromised along with the corresponding encryption key, the data shall be considered unencrypted and thus fall under the notification requirements.
E. Notification may be delayed if a law enforcement agency determines that the notification impedes a criminal investigation. In such case, notification will be delayed only as long as needed to determine that notification no longer compromises any investigation.
F. The North Colonie Central School District will notify the affected individual. Such notice shall be directly provided to the affected persons by one of the following methods:
• written notice;
• electronic notice, provided that the person to whom notice is required has expressly consented to receiving said notice in electronic form and a log of
each such notification is kept by the North Colonie Central School District who notifies affected persons in such form;
• telephone notification provided that a log of each such notification is kept by The North Colonie Central School District who notifies affected persons; or
• Substitute notice, if The North Colonie Central School District demonstrates to the state attorney general that the cost of providing notice would exceed two hundred fifty thousand dollars, or that the affected class of subject persons to be notified exceeds five hundred thousand, or such The North Colonie Central School District does not have sufficient contact information. Substitute notice shall consist of all of the following:
- e-mail notice when North Colonie Central School District has an e-mail address for the subject persons;
- conspicuous posting of the notice on North Colonie School District web site page, if North Colonie Central School District maintains one.
- notification to major statewide media.
G. The North Colonie Central School District shall notify the Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) as to the timing, content and distribution of the notices and approximate number of affected persons.
H. The North Colonie Central School District shall notify the Attorney General and the Consumer Protection Board, whenever notification to a New York resident is necessary, as to the timing, content and distribution of the notices and approximate number of affected persons.
I. Regardless of the method by which notice is provided, such notice shall include contact information for The North Colonie Central School District making the notification and a description of the categories of information that were, or are reasonably believed to have been, acquired by a person without valid authorization, including specification of which of the elements of personal information and private information were, or are reasonably believed to have been, so acquired.
J. This Policy also applies to information maintained on behalf of The North Colonie Central School District by a third party.
Adopted: April 24, 2006
Reviewed, with no changes: January 25, 2010