As per New York State...
New York State Education Law 2-D and the Family Education Rights and Privacy act provide clear protections for student data. New York Department of Education has committed to promoting the least intrusive data collection policies practicable that advances the goals of improving academic achievement, empowering parents with information and advancing efficient and effective school operations while minimizing the collection and transmission of personally identifiable information, and will work to ensure that this is reflected in the practices of every educational agency in New York State by developing policies and standards that provide clear guidance to the field.
Please see NCSD Data Protection Policies including... Parents' Bill of Rights, contact information for directing complaints regarding breaches, and the policy towards Third Party Contracts
NCSD POLICY: Data protection 8635.docx
PARENT FACT SHEET: data-privacy-parent-fact-sheet.pdf