Education Law §§ 2-d, 2-d(1)(c), 2-d(1)(k), 2116-a(3); Public Law 111-5 § 13402(h)(2);
New York Constitution Article V § 1; State Finance Law § 8

The State Comptroller and his designees are not “third party contractors,” as defined
in Education Law § 2-d, when auditing the State Education Department under the
Comptroller’s constitutional authority.

                                      December 21, 2017

Nancy Groenwegen                                            Formal Opinion
Counsel                                                     No. 2017-F1
Office of the State Comptroller
110 State Street, 14th Floor
Albany, New York 12236


Dear Ms. Groenwegen:

       You have requested an opinion regarding whether Education Law § 2-d applies
to the Comptroller or his designees performing an audit of the State Education
Department (SED). Specifically, you have explained that in connection with an audit
of SED’s efforts to reduce chronic absenteeism, designees of the Comptroller
(hereinafter “OSC”) must access student data that is protected by law as confidential
personally identifiable information.1 SED agrees that OSC may access the
information; the disagreement is only as to whether OSC is a “third party contractor,”
as defined in Education Law § 2-d, subject to the special rules, described below, that
govern access to and use of students’ personally identifiable information by third
party contractors. SED has suggested that the confidentiality agreement that OSC
enters with the entities it audits, including SED, constitutes a contract that renders
OSC subject to section 2-d’s rules. As explained below, we are of the opinion that
OSC is not a third party contractor under section 2-d and thus is not subject to that
section’s rules.

       Education Law § 2-d limits the collection and use of personally identifiable
information from the student records maintained by an “educational agency,” which
includes SED. Education Law § 2-d(1)(c). As relevant here, a third party contractor
that receives student data must satisfy certain obligations, including limiting
internal access to education records to those individuals who are determined to have
legitimate educational interests and, to protect data from unauthorized disclosure
while it is in the third party contractor’s custody, using an encryption technology or
methodology specified by the Secretary of the United States Department of Health &
Human Services in guidance issued under section 13402(h)(2) of Public Law 111-5.

1OSC would be subject to the requirements of the federal Family Educational Rights and Privacy
Act to the extent it accesses data protected by that law. 20 U.S.C. § 1232g; 34 C.F.R. Part 99.
       A “third party contractor” is defined by section 2-d to be “any person or entity,
other than an educational agency, that receives student data . . . from an educational
agency pursuant to a contract or other written agreement for purposes of providing
services to such educational agency.” Education Law § 2-d(1)(k).

       The Comptroller and OSC are not “third party contractors” under Education
Law § 2-d. Specifically, they will not be receiving student data from SED “pursuant
to a contract or other written agreement for purposes of providing services to” SED.
The Comptroller is the independent auditing official for the affairs of the State, whose
authority to audit departments of the State derives from the state Constitution.
Patterson v. Carey, 41 N.Y.2d 714, 723 ( 1977); N.Y. Const. Art. V, § 1; see also State
Finance Law § 8. It is under this authority—not pursuant to a contract between OSC
and SED—that he and his designees are conducting the instant audit, in the course
of which they will receive student data from SED. Moreover, the confidentiality
agreement between OSC and SED is not a contract for OSC to provide services to
SED. Finally, while the services that a third party contractor might provide to an
educational agency include “audit or evaluation of publicly funded programs,” this
reference does not draw OSC within the ambit of section 2-d. Education Law § 2-
d(1)(k). We note that school districts—also “educational agencies”—must have an
annual audit conducted by an independent accountant. Education Law § 2116-a(3).
Thus, our conclusion that OSC is not a third party contractor does not render the
“audit” language of section 2-d meaningless.

      In sum, we conclude that the Comptroller and his designees are not “third
party contractors” subject to the requirements for such contractors established by
Education Law § 2-d when auditing SED under the Comptroller’s constitutional
authority.

                                       Very truly yours,


                                       ERIC T. SCHEIDERMAN




                                                                                      2
