S. Town of Manlius Police Department Agreement (SIRO Program)

Agreement between the Town of Manlius Police Department and Fayetteville-Manlius Central School District 

SIRO Program 2024-25 (M. Grogan)

SIRO Program 2024-25 (D. Golden)

SIRO Program 2024-25 (A. Palmer)

SIRO Program 2024-25 (M. Grogan)

THIS AGREEMENT is made this 8th day of May, 2024, by and between the TOWN OF MANLIUS POLICE DEPARTMENT (hereinafter “POLICE DEPARTMENT”) and the FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT (hereinafter “SCHOOL DISTRICT”) as follows:

WHEREAS, the SCHOOL DISTRICT wishes to implement a SCHOOL INFORMATION RESOURCE OFFICER to promote the goal of ensuring a caring, safe, respectful, and orderly learning environment in its schools; and

WHEREAS, the SCHOOL DISTRICT and the POLICE DEPARTMENT desire to establish the terms and scope of duties in this SCHOOL INFORMATION and RESOURCE OFFICER (hereinafter referred to as (“SIRO”) Agreement the specific terms and conditions of the services to be provided by the said SIROs in the SCHOOL DISTRICT:

NOW, THEREFORE, THE PARTIES HERETO AGREE AS FOLLOWS:

Defined terms

For the purposes of this Agreement, the following terms have the meanings listed:
SIRO Supervisor – The POLICE DEPARTMENT employee assigned to supervise the SIRO’s activities.

School Liaison – The SCHOOL DISTRICT employee who is designated as the primary contact for the SIRO and POLICE DEPARTMENT regarding the SIRO’s work.

School Grounds – The school grounds shall consist of all buildings and grounds under jurisdiction of the SCHOOL DISTRICT, including but not limited to the high school, the middle school, the elementary school and the school district offices.

1.0 Goals and Objectives

It is understood and agreed that the SCHOOL DISTRICT and the POLICE DEPARTMENT officials share the following goals and objectives regarding the SIRO Program in the schools:

1.1 The primary duty of the SIRO is to establish relationships with students and to act as a mentor. The SIRO’s law enforcement function is a part of relationship-building with the student body and community.

1.2 The SIRO will foster educational programs and activities that increase student knowledge of and respect for the law and the function of law enforcement agencies;

1.3 The SIRO will be available to work cooperatively with teachers to assist in developing specialty programs specific to areas of study including but not limited to court procedures, citizenship and forensic science;

1.4 The SIRO will conduct criminal investigations with the goals of promoting safety for the school community and establishing a deterrent to delinquent student behavior and promoting and ensuring the safety of the students, faculty and administration of the SCHOOL DISTRICT;

1.5 The SIRO will work with school administrators to identify and address safety issues within the schools;

1.6 The SIRO will serve as a mentor and role model for students attending school in the SCHOOL DISTRICT.

2.0 Employment and Assignment of School Resource Officers

2.1 The SIRO shall be an employee of the POLICE DEPARTMENT and shall be subject to the administration, supervision and control of the POLICE DEPARTMENT, except as such administration, supervision and control is subject to the terms and conditions of this Agreement.

2.2 The POLICE DEPARTMENT agrees to provide and to pay the SIRO’s salary and employment benefits in accordance with the applicable salary schedules and employment practices of the POLICE DEPARTMENT. The SIRO shall be subject to all other personnel and practices of the POLICE DEPARTMENT except as such policies or practices may have to be modified to comply with the terms and conditions of this Agreement.

2.3 The parties shall use a collaborative process in the assignment of a SIRO. Both parties shall have the right to attend and participate in candidate interviews. The POLICE DEPARTMENT shall select three finalists from the candidate pool and the SCHOOL DISTRICT shall select the candidate to be assigned.

2.4 The POLICE DEPARTMENT shall notify the SCHOOL DISTRICT within 24 hours of the termination of the services of a SIRO assigned to the SCHOOL DISTRICT. The SCHOOL DISTRICT has the right to refuse the services of a particular SIRO and shall provide the POLICE DEPARTMENT with 24 hours notice of its intent to do so. Upon such notice by either party, the parties shall meet and confer within 48 hours of such notice to discuss the replacement of the SIRO.

2.5 The POLICE DEPARTMENT shall hold the SCHOOL DISTRICT free, harmless and indemnified from and against any and all claims, suits or causes of action arising out of allegations of unfair or unlawful employment practices bought by SIROs.

2.6 In the event an SIRO is absent from work, the SIRO shall notify both his supervisor in the POLICE DEPARTMENT and the principal of the school to which the SIRO is assigned on that particular day. To the extent possible, the POLICE DEPARTMENT shall provide an interim replacement.

2.7 The relationship of the POLICE DEPARTMENT to the SCHOOL DISTRICT shall be that of independent contractor and neither party shall be an agent of or otherwise have authority to bind the other party.

3.0 Payment Terms and Duty Hours

3.1 The SIRO’s regular duty shall be 40 hours per week for 186 days, and the schedule of these hours shall be set by mutual agreement between the SCHOOL DISTRICT and the POLICE DEPARTMENT. The SCHOOL DISTRICT may contract for additional service days beyond the required 186 days at the per diem rate.

3.2 The SCHOOL DISTRICT shall pay the POLICE DEPARTMENT for the services of SIRO OFFICER FILIP at an average per diem rate of $786.76 for the calendar year of 2024 and a per diem rate of 838.51 for the calendar year of 2025 for the 2024-25 school year. The SCHOOL DISTRICT will pay the POLICE DEPARTMENT at this per diem rate based upon the actual service of SIRO OFFICER FILIP.

3.3 From time to time the SIRO may be required to work more than the 8 hours of regular scheduled duty in a given day. The SIRO has the equal right of first refusal (with the SPOs assigned to the district) on overtime earning opportunities. In such instances of overtime, the additional time worked by the SIRO shall be credited as “school comp time” or overtime. The choice of either school comp time or overtime shall be at the discretion of the SIRO. School comp time may be used to offset days where the SIRO is scheduled to work, but does not have to report due to the closing of school. The maximum amount of comp time that may accumulate at any one time is 40 hours. At the end of the school year, any school comp time that has not been utilized by the SIRO shall be converted to overtime or carried forward into the next school year based upon the SIRO’s request. Authorized overtime for SIRO OFFICER GROGAN shall be billed at a rate of $86.47 per hour for calendar year of 2024 and $91.94 for the calendar year of 2025 for the 2024-25 school year.

3.4 The SIRO shall be on duty upon the school grounds fifteen minutes before the beginning of the student instructional day and shall remain on duty for eight (8) hours unless this schedule modified by the mutual agreement between the POLICE DEPARTMENT and the SCHOOL DISTRICT, or the Principal of the building to which the SIRO is assigned on a given day.

3.5 It is understood and agreed that time spent by the SIRO attending court juvenile and/or criminal cases arising from and/or out of their employment as an SIRO shall be considered as hours worked under this Agreement.

3.6 In the event of an emergency the SIRO may be ordered by the POLICE DEPARTMENT to leave school grounds during normal duty hours as described above to perform other services for the POLICE DEPARTMENT. In such instances, the time spent by the SIRO away from the school grounds shall not be considered billable time by the POLICE DEPARTMENT.

3.7 For school vacations, holidays and other times when school is not in session and/or the SIRO is not required to be on school grounds, the officer may take available leave balances, or report to the SIRO supervisor for reassignment.

4.0 Basic Qualifications of the School Information and Resource Officers (SIRO)

To be an SIRO, an officer must first meet all of the following basic qualifications:

4.1 Shall be a sworn officer and should have a minimum of five years of law enforcement experience;

4.2 Shall possess a sufficient knowledge of the applicable Federal and State laws, Town and County ordinances, and Board of Education policies and regulations;

4.3 Shall be capable of conducting in depth criminal investigations;

4.4 Shall possess even temperament and set a good example for students; and

4.5 Shall possess communication skills that would enable the officer to function effectively within the school environment.

5.0 Duties of School Resource Officer

5.1 To assist school officials with the enforcement of Board of Education Policies and Administrative Regulations regarding student conduct and to provide usual and customary police services to the SCHOOL DISTRICT. The role of school discipline shall remain with the school district administration.

5.2 To counsel public school students in special situations when requested by the principal or the principal’s designee or by the parents of a student;

5.3 To answer questions and conduct classroom presentations for students in law-related fields;

5.4 To perform such other duties as the parties may agree from time to time.

5.5 The SIRO shall not detain or question students regarding their immigration status.

6.0 Chain of Command

6.1 As employees of the POLICE DEPARTMENT, the SIRO shall follow the chain of command as set forth in the POLICE DEPARTMENT Policies and Procedure Manual, except where such procedures conflict with the policies of the Board of Education of the SCHOOL DISTRICT. It is expressly recognized and acknowledged by the SCHOOL DISTRICT that policies of the Board of Education cannot supersede the SIRO’s duty to act in accordance with state and federal law.

6.2 In the performance of the duties described herein, the SIRO shall regularly coordinate and communicate with the principal or the principals’ designee of the schools to which they are assigned. The principal or designee shall contact the SIRO Supervisor assigned by the POLICE DEPARTMENT for such purpose in the event of any question regarding the performance of duties by an SIRO.

7.0 Training/Briefing

7.1 The SIRO may be required by the POLICE DEPARTMENT to attend monthly training and briefing sessions. These sessions will be held at the direction of the POLICE DEPARTMENT Operations commander. Briefing Sessions will be conducted to provide for the exchange of information between the department and the school liaison.

7.2 The SCHOOL DISTRICT and the POLICE DEPARTMENT shall schedule training for the SIRO in Board of Education Policies, regulations and procedures, including the Code of Conduct for students and others and the programs and practices of the SCHOOL DISTRICT regarding student discipline.

8.0 Dress Code

8.1 The SIRO shall work primarily in either a departmental issued uniform or plain clothes business attire while on duty. The decision regarding the attire to be worn shall be made in consultation between the parties.

9.0 Supplies and Equipment

9.1 Motor vehicles. The POLICE DEPARTMENT shall provide a vehicle for the SIRO. Beginning in 2017, newly assigned vehicles shall be marked in the same manner as patrol vehicles assigned to the Field Services Section. There will be a yearly fee of $3,500 for the vehicle, payable to the Town.

9.2 Office Supplies. The SCHOOL DISTRICT agrees to provide each SIRO with the usual and customary office supplies and forms required in the performance of their duties. In addition, the SIRO shall be provided a private office within the school that is accessible by the students. The SIRO shall also be provided by the SCHOOL DISTRICT a computer, printer and access to a private fax machine for confidential intelligence sharing with other POLICE DEPARTMENT personnel, and a communication device.

9.3 Body Worn Camera (BWC): Body worn cameras are a common law enforcement tool and are utilized by all TMPD patrol officers. A BWC will be utilized by the SIRO; in the school setting the SIRO shall have the discretion to record contacts when they consider it to be in the best interest of the student, staff, school administrators or the SIRO.

10.0 Transporting Students

10.1 It is agreed that SIROs shall not transport students in their vehicles except when the students are victims of a crime, under arrest, or some other emergency circumstance exists.

10.2 If circumstances other than an arrest require that the SIRO transport a student, then an effort shall be made to have a school administrator shall accompany the officer and the student in the vehicle. When a school administrator is not available the SIRO shall record the transport using a body worn camera.

10.3 Students shall not be transported to any location unless it is determined that the student’s parent, guardian or custodian is at the destination to which the student is being transported. The SIRO shall not transport students in their personal vehicles.

10.4 The SIRO shall notify the building principal before moving a student from the school grounds.

11.0 Access to Education Records

11.1 School officials shall allow SIROs to inspect and copy any public records maintained by the school that is permissible by law.

11.2 If some information in a student’s cumulative record is needed in an emergency to protect the health or safety of the student or other individuals, school officials may disclose to the SIRO that information which is needed to respond to the emergency situation based on the seriousness of the threat to someone’s health or safety; the need of the information to meet the emergency situation and the extent to which time is of the essence.

11.3 If confidential student records information is needed, but no emergency situation exists, the information may be released only upon the issuance of a search warrant or subpoena to produce the records, or as may otherwise comply with the Family Educational Rights and Privacy Act (FERPA).

11.4 Pursuant to FERPA, the SCHOOL DISTRICT hereby designates each SIRO as the District’s “law enforcement unit” for the purpose of enforcing any Federal, State or local law and maintaining the physical security and safety of the schools to which they are assigned, and as such shall have access to student education records as appropriate in order to carry out their SIRO duties.

12.0 Term of Agreement

12.1 The term of this agreement is one year commencing on July 1, 2024 and ending on June 30, 2025. The Agreement may be renewed and extended annually by the written agreement of both the SCHOOL DISTRICT and the POLICE DEPARTMENT. Written notice of intent to extend the Agreement must be sent by each party no later than June 1st of the current year.

12.2 In the event that the SCHOOL DISTRICT opts not to extend the Agreement in a given year, it shall remain responsible to pay the per diem charges that would otherwise have been due for the months of September and October of the succeeding year.

13.0 Insurance and Indemnification

13.1 The POLICE DEPARTMENT shall maintain in full force and effect during the term of this Agreement a comprehensive liability insurance policy with coverage that is consistent with police department policies and procedures.

13.2 Without waiving any defenses, the POLICE DEPARTMENT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the SCHOOL DISTRICT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. The SCHOOL DISTRICT shall provide notice to the POLICE DEPARTMENT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the SCHOOL DISTRICT, would cause the SCHOOL DISTRICT to suffer or incur loss or expense.

13.3 Without waiving any defenses, the SCHOOL DISTRICT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the POLICE DEPARTMENT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. POLICE DEPARTMENT shall provide notice to the SCHOOL DISTRICT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the POLICE DEPARTMENT, would cause the POLICE DEPARTMENT to suffer or incur loss or expense.

14.0 Evaluation

It is mutually agreed that the SCHOOL DISTRICT shall annually evaluate the SIRO Program and the parties agree that an exchange of data related to the SIRO’s performance shall be a part of the annual evaluation process.

15.0 Protection of Confidential Data

The Town shall provide their Services in a manner which protects Student Data (as defined by 8 NYCRR 121.1(q)) and Teacher or Principal Data (as defined by 8 NYCRR 121.1(r)) (hereinafter “Confidential Data”) in accordance with the requirements articulated under Federal, New York State and local laws and regulations, including but not limited to the foregoing:

(a) The Town will adopt technologies, safeguards and practices that align with the NIST Cybersecurity Framework.

(b) The Town will comply with the School District Data Security and Privacy Policy, Education Law § 2-d, and 8 NYCRR §121.

(c) The Town will limit internal access to personally identifiable information to only those employees or sub-contractors that need access to provide the contracted services.

(d) The Town will not use the personally identifiable information for any purpose not explicitly authorized in this Agreement.

(e) The Town will not disclose any personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless otherwise authorized pursuant to applicable law.

(f) The Town will maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personally identifiable information in its custody.

(g) The Town will use encryption to protect personally identifiable information in its custody while in motion or at rest.

(h) The Town will not sell personally identifiable information nor use or disclose it for any marketing or commercial purpose or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so.

(i) In the event the Town engages a subcontractor to perform their contractual obligations, the data protection obligations imposed on the Town shall apply to the subcontractor.

16.0 Data Breach

In the event that Confidential Data is accessed or obtained by an unauthorized individual, the Town shall provide notification to the School District without unreasonable delay and not more than seven calendar days after the discovery of such breach. The Town shall follow the following process:

(a) The security breach notification shall be titled “Notice of Data Breach,” shall be clear, concise, use language that is plain and easy to understand, and to the extent available, shall include: a brief description of the breach or unauthorized release; the dates of the incident in the date of discovery; a description of the types of Confidential affected; an estimate of the number of records affected; a brief description of the Town’s investigation or plan to investigate; and contact information for representatives who can assist the School District with additional questions.

(b) The Town shall also prepare a statement for parents and eligible students which provides information under the following categories: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.”

(c) Where a breach or unauthorized release of Confidential Data is attributed to Contractor, and/or a subcontractor or affiliate of the Town, The Town shall pay for or promptly reimburse the School District for the cost of notification to parents and eligible students of the breach.

(d) The Town shall cooperate with the School District and law enforcement to protect the integrity of investigations into the breach or unauthorized release of Confidential Data.

i. The name and contact information of the reporting School District subject to this section.

ii. A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

iii. If the information is possible to determine at the time the notice is provided, then either (1) the date of the breach, (2) the estimated date of the breach, or (3) the date range within which the breach occurred. The notification shall also include the date of the notice.

iv. Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.

v. A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

vi. Information about what the agency has done to protect individuals whose information has been breached.

vii. Advice on steps that the person whose information has been breached may take to protect himself or herself.

(e) The Town further acknowledges and agrees to have a written incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of Protected Data or any portion thereof, and agrees to provide Client, upon request, with a copy of said written incident response plan.

IN WITNESS WHEREOF, the parties hereto have caused this Operations Agreement to be executed the day and year first written above.

FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT
Dr. Craig Tice, Superintendent of Schools

MANLIUS POLICE DEPARTMENT
Michael Crowell, Chief of Police

TOWN OF MANLIUS
Edmond Theobald, Town Supervisor

Addendum A

PARENTS’ BILL OF RIGHTS FOR DATA PRIVACY AND SECURITY

Fayetteville-Manlius is committed to ensuring student privacy in accordance with local, state and federal regulations and district policies. To this end and pursuant to U.S. Department of Education (DOE) regulations (Education Law §2-d), the district is providing the following Parents’ Bill of Rights for
Data Privacy and Security:

  • A student’s personally identifiable information cannot be sold or released for any commercial or marketing purposes.
  • Parents have the right to inspect and review the complete contents of their child’s education record, including any student data maintained by the Fayetteville-Manlius School District. This right of inspection of records is consistent with the federal Family Educational Rights and Privacy Act (FERPA). Under the more recently adopted regulations (Education Law §2-d), the rights of inspection are extended to include data, meaning parents have the right to inspect any data in their child’s educational record. The New York State Education Department (SED) will develop further policies and procedures related to these rights in the future.
  • State and federal laws protect the confidentiality of personally identifiable information and safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls and password protection, must be in place when data is stored or transferred.
  • A complete list of all student data elements collected by the state is available for public review in an Excel file at
    http://www.p12.nysed.gov/irs/sirs/documentation/NYSEDstudentData.xlsx.
  • Parents may also obtain a copy of this list by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, N.Y. 12234.
  • Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be directed to: Mary Coughlin, Assistant Superintendent for Instruction, Fayetteville-Manlius School District, 8199 E. Seneca Turnpike, Manlius, NY 13104. Complaints to SED should be directed to: Chief Privacy Officer, New York State Education Department, 89
    Washington Avenue, Albany, NY 12234; the e-mail address is cpo@mail.nysed.gov.

Addendum B

PARENTS’ BILL OF RIGHTS – SUPPLEMENTAL INFORMATION ADDENDUM
  1. EXCLUSIVE PURPOSES FOR DATA USE: The exclusive purposes for which “student data” or “teacher or principal data” (as those terms are defined in Education Law Section 2-d and collectively referred to as the “Confidential Data”) will be used by Town of Manlius and the Town of Manlius Police Department (referred to jointly as the “Town”) are limited to the purposes authorized in the contract between the Town and the Fayetteville-Manlius Central School District (the “School District”) commencing on July 1, 2021 and expiring on June 30, 2022 (the “Contract”).
  2. SUBCONTRACTOR OVERSIGHT DETAILS: The Town will ensure that any subcontractors, or other authorized persons or entities to whom the Town will disclose the Confidential Data, if any, are contractually required to abide by all applicable data protection and security requirements, including but not limited to those outlined in applicable state and federal laws and regulations (e.g., Family Educational Rights and Privacy Act (“FERPA”); Education Law §2-d; 8 NYCRR Part 121).
  3. CONTRACT PRACTICES: The Contract commences and expires on the dates set forth in the Contract, unless earlier terminated or renewed pursuant to the terms of the Contract. On or before the date the Contract expires, protected data will be exported to the School District in [insert data format] format and/or destroyed by the Town as directed by the School District.
  4. DATA ACCURACY/CORRECTION PRACTICES: A parent or eligible student can challenge the accuracy of any “education record”, as that term is defined in the FERPA, stored by the School District in a Town’s product and/or service by following the School District’s procedure for requesting the amendment of education records under the FERPA. Teachers and principals may be able to challenge the accuracy of APPR data stored by School District in Town’s product and/or service by following the appeal procedure in the School District’s APPR Plan. Unless otherwise required above or by other applicable law, challenges to the accuracy of the Confidential Data shall not be permitted.
  5. SECURITY PRACTICES: Confidential Data provided to Town by the School District will be stored [insert location]. The measures that Town takes to protect Confidential Data will align with the NIST Cybersecurity Framework including, but not necessarily limited to, disk encryption, file encryption, firewalls, and password protection.
  6. ENCRYPTION PRACTICES: The Town will apply encryption to the Confidential Data while in motion and at rest at least to the extent required by Education Law Section 2-d and other applicable law.
DATA SECURITY AND PRIVACY PLAN

WHEREAS, the Fayetteville-Manlius Central School District (hereinafter “School District”) and Town of Manlius (hereinafter “Contractor”) entered into an agreement dated 9-18-2020 (hereinafter “Agreement”) for a School Information Resource Officer (hereinafter “Services”).

WHEREAS, pursuant to the requirements under 8 NYCRR 121, Contractor maintains the data security and privacy plan described herein in connection with the Services provided to the School District.

  1. During the term of the Agreement, Contractor will implement all state, federal and local data security and privacy requirements, consistent with the School District’s Data Security and Privacy Policy in the following way(s):
    • Utilizing a password protected, Virtual Private Network (VPN) with industry standard encryption.
  2. Contractor has in place the following administrative, operational and technical safeguards and practices to protect personally identifiable information that it will receive under the Agreement:
    • Mandatory 90-day password reset for each user. VPN with industry standard encryption. Industry standard firewall in place and updated as needed. Active directory auditing to monitor for potential breaches.
  3. Contractor shall comply with 8 NYCRR 121 in that it acknowledges that it has reviewed the School District’s Parents Bill of Rights for Data Privacy and Security and will comply with same.

a. Contractor will use the student data or teacher or principal data only for the exclusive purposes defined in the Agreement.

b. Contractor will ensure that the subcontractor(s) or other authorized
persons or entities to whom Contractor will disclose the student data or
teacher and principal data, if any, will abide by all applicable data  protection and security requirements as described in the “Supplemental Information” appended to the Agreement.

c. At the end of the term of the Agreement, Contractor will destroy, transition or return, at the direction of the School District, all student data and all teacher and principal data in accordance with the “Supplemental Information” appended to the Agreement.

d. Student data and teacher and principal data will be stored in accordance with the “Supplemental Information” appended to the Agreement.

e. Student data and teacher and principal data in motion and at rest will be protected using an encryption method that meets the standards described in 8 NYCRR 121.

4. Prior to receiving access to student data and/or teacher and principal data, officer(s) and employee(s) of Contractor and any assignees who will have access to student data or teacher or principal data shall receive training on the federal and state laws governing confidentiality of such data. Such training shall be provided:
Specify date of each training

    • Town of Manlius Police Department will provide training to the Officers on industry standard computer security protocols in order to prevent unauthorized access.

5. Subcontractors (check one):

__ Contractor shall not utilize sub-contractors.

X Contractor shall utilize sub-contractors. Contractor shall manage the relationships and contracts with such sub-contractors in the following ways in order to ensure personally identifiable information is protected:

        • Before a sub-contractor is brought in to support the efforts of the Town of Manlius Police Department in its role of providing services to the FM Schools, background checks will be conducted for each individual prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.
        • Additionally, a Business Associates’ Agreement (BAA) will be presented to and signed by all sub-contractors prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.

6. Contractor has the following procedures, plans or protocols in place to  manage data security and privacy incidents that implicate personally identifiable information:
Procedures, plans or protocols must, at a minimum, specify plans to identify breaches and unauthorized disclosures, and to promptly notify the School District.

    • 24-hour monitoring of servers by IT provider to identify unauthorized access. If a breach is detected a procedure is in place to notify applicable administrators so that applicable accounts can be shut down to prevent further access.

7. Termination of Agreement.

a. Within ___ days of termination of the Agreement, Contractor shall delete
or destroy all student data or teacher or principal data in its possession; AND

b. Within ___ days of termination of the Agreement, Contractor shall
Return all data to the School District using _________; OR

X Transition all data to a successor contractor designated by the School
District in writing:

    • The Town of Manlius Police Department does not retain any data that is outside of a police report. SIROs/SPOs may access the data but it is “view Only” and not retained by the department. Data may be used in a police report. The destruction of police reports is governed by the New York State Archives Records Retention and Disposition Schedule.

8. In the event of a conflict between the terms of this Data Security and Privacy Plan and the terms of the Agreement, the terms of this Data Security and Privacy Plan shall control. All of the defined terms in the Agreement shall have the same definitions in the Data Security and Privacy Plan, unless otherwise defined herein. Except as expressly set forth in this Data Security and Privacy Plan, the terms and conditions of the Agreement shall remain unmodified and in full force and effect.

IN WITNESS WHEREOF, the Contractor hereto has executed this Data Security and Privacy Plan as of Aug. 9,  2021.

Contractor: Edmond J. Theobald, Town Supervisor


SIRO Program 2024-25 (D. Golden) 

THIS AGREEMENT is made this 8th day of May, 2024, by and between the TOWN OF MANLIUS POLICE DEPARTMENT (hereinafter “POLICE DEPARTMENT”) and the FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT (hereinafter “SCHOOL DISTRICT”) as follows:

WHEREAS, the SCHOOL DISTRICT wishes to implement a SCHOOL INFORMATION RESOURCE OFFICER to promote the goal of ensuring a caring, safe, respectful, and orderly learning environment in its schools; and

WHEREAS, the SCHOOL DISTRICT and the POLICE DEPARTMENT desire to establish the terms and scope of duties in this SCHOOL INFORMATION and RESOURCE OFFICER (hereinafter referred to as (“SIRO”) Agreement the specific terms and conditions of the services to be provided by the said SIROs in the SCHOOL DISTRICT:

NOW, THEREFORE, THE PARTIES HERETO AGREE AS FOLLOWS:

Defined terms

For the purposes of this Agreement, the following terms have the meanings listed:
SIRO Supervisor – The POLICE DEPARTMENT employee assigned to supervise the SIRO’s activities.

School Liaison – The SCHOOL DISTRICT employee who is designated as the primary contact for the SIRO and POLICE DEPARTMENT regarding the SIRO’s work.

School Grounds – The school grounds shall consist of all buildings and grounds under jurisdiction of the SCHOOL DISTRICT, including but not limited to the high school, the middle school, the elementary school and the school district offices.

1.0 Goals and Objectives

It is understood and agreed that the SCHOOL DISTRICT and the POLICE DEPARTMENT officials share the following goals and objectives regarding the SIRO Program in the schools:

1.1 The primary duty of the SIRO is to establish relationships with students and to act as a mentor. The SIRO’s law enforcement function is a part of relationship-building with the student body and community.

1.2 The SIRO will foster educational programs and activities that increase student knowledge of and respect for the law and the function of law enforcement agencies;

1.3 The SIRO will be available to work cooperatively with teachers to assist in developing specialty programs specific to areas of study including but not limited to court procedures, citizenship and forensic science;

1.4 The SIRO will conduct criminal investigations with the goals of promoting safety for the school community and establishing a deterrent to delinquent student behavior and promoting and ensuring the safety of the students, faculty and administration of the SCHOOL DISTRICT;

1.5 The SIRO will work with school administrators to identify and address safety issues within the schools;

1.6 The SIRO will serve as a mentor and role model for students attending school in the SCHOOL DISTRICT.

2.0 Employment and Assignment of School Resource Officers

2.1 The SIRO shall be an employee of the POLICE DEPARTMENT and shall be subject to the administration, supervision and control of the POLICE DEPARTMENT, except as such administration, supervision and control is subject to the terms and conditions of this Agreement.

2.2 The POLICE DEPARTMENT agrees to provide and to pay the SIRO’s salary and employment benefits in accordance with the applicable salary schedules and employment practices of the POLICE DEPARTMENT. The SIRO shall be subject to all other personnel and practices of the POLICE DEPARTMENT except as such policies or practices may have to be modified to comply with the terms and conditions of this Agreement.

2.3 The parties shall use a collaborative process in the assignment of a SIRO. Both parties shall have the right to attend and participate in candidate interviews. The POLICE DEPARTMENT shall select three finalists from the candidate pool and the SCHOOL DISTRICT shall select the candidate to be assigned.

2.4 The POLICE DEPARTMENT shall notify the SCHOOL DISTRICT within 24 hours of the termination of the services of a SIRO assigned to the SCHOOL DISTRICT. The SCHOOL DISTRICT has the right to refuse the services of a particular SIRO and shall provide the POLICE DEPARTMENT with 24 hours notice of its intent to do so. Upon such notice by either party, the parties shall meet and confer within 48 hours of such notice to discuss the replacement of the SIRO.

2.5 The POLICE DEPARTMENT shall hold the SCHOOL DISTRICT free, harmless and indemnified from and against any and all claims, suits or causes of action arising out of allegations of unfair or unlawful employment practices bought by SIROs.

2.6 In the event an SIRO is absent from work, the SIRO shall notify both his supervisor in the POLICE DEPARTMENT and the principal of the school to which the SIRO is assigned on that particular day. To the extent possible, the POLICE DEPARTMENT shall provide an interim replacement.

2.7 The relationship of the POLICE DEPARTMENT to the SCHOOL DISTRICT shall be that of independent contractor and neither party shall be an agent of or otherwise have authority to bind the other party.

3.0 Payment Terms and Duty Hours

3.1 The SIRO’s regular duty shall be 40 hours per week for 186 days, and the schedule of these hours shall be set by mutual agreement between the SCHOOL DISTRICT and the POLICE DEPARTMENT. The SCHOOL DISTRICT may contract for additional service days beyond the required 186 days at the per diem rate.

3.2 The SCHOOL DISTRICT shall pay the POLICE DEPARTMENT for the services of SIRO OFFICER GOLDEN at an average per diem rate of $791.42 for the calendar year of 2024 and a per diem rate of 838.51 for the calendar year of 2025 for the 2024-25 school year. The SCHOOL DISTRICT will pay the POLICE DEPARTMENT at this per diem rate based upon the actual service of SIRO OFFICER GOLDEN.

3.3 From time to time the SIRO may be required to work more than the 8 hours of regular scheduled duty in a given day. The SIRO has the equal right of first refusal (with the SPOs assigned to the district) on overtime earning opportunities. In such instances of overtime, the additional time worked by the SIRO shall be credited as “school comp time” or overtime. The choice of either school comp time or overtime shall be at the discretion of the SIRO. School comp time may be used to offset days where the SIRO is scheduled to work, but does not have to report due to the closing of school. The maximum amount of comp time that may accumulate at any one time is 40 hours. At the end of the school year, any school comp time that has not been utilized by the SIRO shall be converted to overtime or carried forward into the next school year based upon the SIRO’s request. Authorized overtime for SIRO OFFICER GOLDEN shall be billed at a rate of $87.74 per hour for the 2024 calendar year and $93.29 per hour for the 2025 calendar year for the 2024-25 school year.

3.4 The SIRO shall be on duty upon the school grounds fifteen minutes before the beginning of the student instructional day and shall remain on duty for eight (8) hours unless this schedule modified by the mutual agreement between the POLICE DEPARTMENT and the SCHOOL DISTRICT, or the Principal of the building to which the SIRO is assigned on a given day.

3.5 It is understood and agreed that time spent by the SIRO attending court juvenile and/or criminal cases arising from and/or out of their employment as an SIRO shall be considered as hours worked under this Agreement.

3.6 In the event of an emergency the SIRO may be ordered by the POLICE DEPARTMENT to leave school grounds during normal duty hours as described above to perform other services for the POLICE DEPARTMENT. In such instances, the time spent by the SIRO away from the school grounds shall not be considered billable time by the POLICE DEPARTMENT.

3.7 For school vacations, holidays and other times when school is not in session and/or the SIRO is not required to be on school grounds, the officer may take available leave balances, or report to the SIRO supervisor for reassignment.

4.0 Basic Qualifications of the School Information and Resource Officers (SIRO)

To be an SIRO, an officer must first meet all of the following basic qualifications:

4.1 Shall be a sworn officer and should have a minimum of five years of law enforcement experience;

4.2 Shall possess a sufficient knowledge of the applicable Federal and State laws, Town and County ordinances, and Board of Education policies and regulations;

4.3 Shall be capable of conducting in depth criminal investigations;

4.4 Shall possess even temperament and set a good example for students; and

4.5 Shall possess communication skills that would enable the officer to function effectively within the school environment.

5.0 Duties of School Resource Officer

5.1 To assist school officials with the enforcement of Board of Education Policies and Administrative Regulations regarding student conduct and to provide usual and customary police services to the SCHOOL DISTRICT. The role of school discipline shall remain with the school district administration.

5.2 To counsel public school students in special situations when requested by the principal or the principal’s designee or by the parents of a student;

5.3 To answer questions and conduct classroom presentations for students in law-related fields;

5.4 To perform such other duties as the parties may agree from time to time.

5.5 The SIRO shall not detain or question students regarding their immigration status.

6.0 Chain of Command

6.1 As employees of the POLICE DEPARTMENT, the SIRO shall follow the chain of command as set forth in the POLICE DEPARTMENT Policies and Procedure Manual, except where such procedures conflict with the policies of the Board of Education of the SCHOOL DISTRICT. It is expressly recognized and acknowledged by the SCHOOL DISTRICT that policies of the Board of Education cannot supersede the SIRO’s duty to act in accordance with state and federal law.

6.2 In the performance of the duties described herein, the SIRO shall regularly coordinate and communicate with the principal or the principals’ designee of the schools to which they are assigned. The principal or designee shall contact the SIRO Supervisor assigned by the POLICE DEPARTMENT for such purpose in the event of any question regarding the performance of duties by an SIRO.

7.0 Training/Briefing

7.1 The SIRO may be required by the POLICE DEPARTMENT to attend monthly training and briefing sessions. These sessions will be held at the direction of the POLICE DEPARTMENT Operations commander. Briefing Sessions will be conducted to provide for the exchange of information between the department and the school liaison.

7.2 The SCHOOL DISTRICT and the POLICE DEPARTMENT shall schedule training for the SIRO in Board of Education Policies, regulations and procedures, including the Code of Conduct for students and others and the programs and practices of the SCHOOL DISTRICT regarding student discipline.

8.0 Dress Code

8.1 The SIRO shall work primarily in either a departmental issued uniform or plain clothes business attire while on duty. The decision regarding the attire to be worn shall be made in consultation between the parties.

9.0 Supplies and Equipment

9.1 Motor vehicles. The POLICE DEPARTMENT shall provide a vehicle for the SIRO. Beginning in 2017, newly assigned vehicles shall be marked in the same manner as patrol vehicles assigned to the Field Services Section. There will be a yearly fee of $3,500 for the vehicle, payable to the Town.

9.2 Office Supplies. The SCHOOL DISTRICT agrees to provide each SIRO with the usual and customary office supplies and forms required in the performance of their duties. In addition, the SIRO shall be provided a private office within the school that is accessible by the students. The SIRO shall also be provided by the SCHOOL DISTRICT a computer, printer and access to a private fax machine for confidential intelligence sharing with other POLICE DEPARTMENT personnel, and a communication device.

9.3 Body Worn Camera (BWC): Body worn cameras are a common law enforcement tool and are utilized by all TMPD patrol officers. A BWC will be utilized by the SIRO; in the school setting the SIRO shall have the discretion to record contacts when they consider it to be in the best interest of the student, staff, school administrators or the SIRO.

10.0 Transporting Students

10.1 It is agreed that SIROs shall not transport students in their vehicles except when the students are victims of a crime, under arrest, or some other emergency circumstance exists.

10.2 If circumstances other than an arrest require that the SIRO transport a student, then an effort shall be made to have a school administrator shall accompany the officer and the student in the vehicle. When a school administrator is not available the SIRO shall record the transport using a body worn camera.

10.3 Students shall not be transported to any location unless it is determined that the student’s parent, guardian or custodian is at the destination to which the student is being transported. The SIRO shall not transport students in their personal vehicles.

10.4 The SIRO shall notify the building principal before moving a student from the school grounds.

11.0 Access to Education Records

11.1 School officials shall allow SIROs to inspect and copy any public records maintained by the school that is permissible by law.

11.2 If some information in a student’s cumulative record is needed in an emergency to protect the health or safety of the student or other individuals, school officials may disclose to the SIRO that information which is needed to respond to the emergency situation based on the seriousness of the threat to someone’s health or safety; the need of the information to meet the emergency situation and the extent to which time is of the essence.

11.3 If confidential student records information is needed, but no emergency situation exists, the information may be released only upon the issuance of a search warrant or subpoena to produce the records, or as may otherwise comply with the Family Educational Rights and Privacy Act (FERPA).

11.4 Pursuant to FERPA, the SCHOOL DISTRICT hereby designates each SIRO as the District’s “law enforcement unit” for the purpose of enforcing any Federal, State or local law and maintaining the physical security and safety of the schools to which they are assigned, and as such shall have access to student education records as appropriate in order to carry out their SIRO duties.

12.0 Term of Agreement

12.1 The term of this agreement is one year commencing on July 1, 2024 and ending on June 30, 2025. The Agreement may be renewed and extended annually by the written agreement of both the SCHOOL DISTRICT and the POLICE DEPARTMENT. Written notice of intent to extend the Agreement must be sent by each party no later than June 1st of the current year.

12.2 In the event that the SCHOOL DISTRICT opts not to extend the Agreement in a given year, it shall remain responsible to pay the per diem charges that would otherwise have been due for the months of September and October of the succeeding year.

13.0 Insurance and Indemnification

13.1 The POLICE DEPARTMENT shall maintain in full force and effect during the term of this Agreement a comprehensive liability insurance policy with coverage that is consistent with police department policies and procedures.

13.2 Without waiving any defenses, the POLICE DEPARTMENT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the SCHOOL DISTRICT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. The SCHOOL DISTRICT shall provide notice to the POLICE DEPARTMENT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the SCHOOL DISTRICT, would cause the SCHOOL DISTRICT to suffer or incur loss or expense.

13.3 Without waiving any defenses, the SCHOOL DISTRICT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the POLICE DEPARTMENT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. POLICE DEPARTMENT shall provide notice to the SCHOOL DISTRICT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the POLICE DEPARTMENT, would cause the POLICE DEPARTMENT to suffer or incur loss or expense.

14.0 Evaluation

It is mutually agreed that the SCHOOL DISTRICT shall annually evaluate the SIRO Program and the parties agree that an exchange of data related to the SIRO’s performance shall be a part of the annual evaluation process.

15.0 Protection of Confidential Data

The Town shall provide their Services in a manner which protects Student Data (as defined by 8 NYCRR 121.1(q)) and Teacher or Principal Data (as defined by 8 NYCRR 121.1(r)) (hereinafter “Confidential Data”) in accordance with the requirements articulated under Federal, New York State and local laws and regulations, including but not limited to the foregoing:

(a) The Town will adopt technologies, safeguards and practices that align with the NIST Cybersecurity Framework.

(b) The Town will comply with the School District Data Security and Privacy Policy, Education Law § 2-d, and 8 NYCRR §121.

(c) The Town will limit internal access to personally identifiable information to only those employees or sub-contractors that need access to provide the contracted services.

(d) The Town will not use the personally identifiable information for any purpose not explicitly authorized in this Agreement.

(e) The Town will not disclose any personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless otherwise authorized pursuant to applicable law.

(f) The Town will maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personally identifiable information in its custody.

(g) The Town will use encryption to protect personally identifiable information in its custody while in motion or at rest.

(h) The Town will not sell personally identifiable information nor use or disclose it for any marketing or commercial purpose or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so.

(i) In the event the Town engages a subcontractor to perform their contractual obligations, the data protection obligations imposed on the Town shall apply to the subcontractor.

16.0 Data Breach

In the event that Confidential Data is accessed or obtained by an unauthorized individual, the Town shall provide notification to the School District without unreasonable delay and not more than seven calendar days after the discovery of such breach. The Town shall follow the following process:

(a) The security breach notification shall be titled “Notice of Data Breach,” shall be clear, concise, use language that is plain and easy to understand, and to the extent available, shall include: a brief description of the breach or unauthorized release; the dates of the incident in the date of discovery; a description of the types of Confidential affected; an estimate of the number of records affected; a brief description of the Town’s investigation or plan to investigate; and contact information for representatives who can assist the School District with additional questions.

(b) The Town shall also prepare a statement for parents and eligible students which provides information under the following categories: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.”

(c) Where a breach or unauthorized release of Confidential Data is attributed to Contractor, and/or a subcontractor or affiliate of the Town, The Town shall pay for or promptly reimburse the School District for the cost of notification to parents and eligible students of the breach.

(d) The Town shall cooperate with the School District and law enforcement to protect the integrity of investigations into the breach or unauthorized release of Confidential Data.

i. The name and contact information of the reporting School District subject to this section.

ii. A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

iii. If the information is possible to determine at the time the notice is provided, then either (1) the date of the breach, (2) the estimated date of the breach, or (3) the date range within which the breach occurred. The notification shall also include the date of the notice.

iv. Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.

v. A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

vi. Information about what the agency has done to protect individuals whose information has been breached.

vii. Advice on steps that the person whose information has been breached may take to protect himself or herself.

(e) The Town further acknowledges and agrees to have a written incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of Protected Data or any portion thereof, and agrees to provide Client, upon request, with a copy of said written incident response plan.

IN WITNESS WHEREOF, the parties hereto have caused this Operations Agreement to be executed the day and year first written above.

FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT
Dr. Craig Tice, Superintendent of Schools

MANLIUS POLICE DEPARTMENT
Michael Crowell, Chief of Police

TOWN OF MANLIUS
Edmond Theobald, Town Supervisor

Addendum A

PARENTS’ BILL OF RIGHTS FOR DATA PRIVACY AND SECURITY

Fayetteville-Manlius is committed to ensuring student privacy in accordance with local, state and federal regulations and district policies. To this end and pursuant to U.S. Department of Education (DOE) regulations (Education Law §2-d), the district is providing the following Parents’ Bill of Rights for
Data Privacy and Security:

  • A student’s personally identifiable information cannot be sold or released for any commercial or marketing purposes.
  • Parents have the right to inspect and review the complete contents of their child’s education record, including any student data maintained by the Fayetteville-Manlius School District. This right of inspection of records is consistent with the federal Family Educational Rights and Privacy Act (FERPA). Under the more recently adopted regulations (Education Law §2-d), the rights of inspection are extended to include data, meaning parents have the right to inspect any data in their child’s educational record. The New York State Education Department (SED) will develop further policies and procedures related to these rights in the future.
  • State and federal laws protect the confidentiality of personally identifiable information and safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls and password protection, must be in place when data is stored or transferred.
  • A complete list of all student data elements collected by the state is available for public review in an Excel file at
    http://www.p12.nysed.gov/irs/sirs/documentation/NYSEDstudentData.xlsx.
  • Parents may also obtain a copy of this list by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, N.Y. 12234.
  • Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be directed to: Mary Coughlin, Assistant Superintendent for Instruction, Fayetteville-Manlius School District, 8199 E. Seneca Turnpike, Manlius, NY 13104. Complaints to SED should be directed to: Chief Privacy Officer, New York State Education Department, 89
    Washington Avenue, Albany, NY 12234; the e-mail address is cpo@mail.nysed.gov.

Addendum B

PARENTS’ BILL OF RIGHTS – SUPPLEMENTAL INFORMATION ADDENDUM
  1. EXCLUSIVE PURPOSES FOR DATA USE: The exclusive purposes for which “student data” or “teacher or principal data” (as those terms are defined in Education Law Section 2-d and collectively referred to as the “Confidential Data”) will be used by Town of Manlius and the Town of Manlius Police Department (referred to jointly as the “Town”) are limited to the purposes authorized in the contract between the Town and the Fayetteville-Manlius Central School District (the “School District”) commencing on July 1, 2021 and expiring on June 30, 2022 (the “Contract”).
  2. SUBCONTRACTOR OVERSIGHT DETAILS: The Town will ensure that any subcontractors, or other authorized persons or entities to whom the Town will disclose the Confidential Data, if any, are contractually required to abide by all applicable data protection and security requirements, including but not limited to those outlined in applicable state and federal laws and regulations (e.g., Family Educational Rights and Privacy Act (“FERPA”); Education Law §2-d; 8 NYCRR Part 121).
  3. CONTRACT PRACTICES: The Contract commences and expires on the dates set forth in the Contract, unless earlier terminated or renewed pursuant to the terms of the Contract. On or before the date the Contract expires, protected data will be exported to the School District in [insert data format] format and/or destroyed by the Town as directed by the School District.
  4. DATA ACCURACY/CORRECTION PRACTICES: A parent or eligible student can challenge the accuracy of any “education record”, as that term is defined in the FERPA, stored by the School District in a Town’s product and/or service by following the School District’s procedure for requesting the amendment of education records under the FERPA. Teachers and principals may be able to challenge the accuracy of APPR data stored by School District in Town’s product and/or service by following the appeal procedure in the School District’s APPR Plan. Unless otherwise required above or by other applicable law, challenges to the accuracy of the Confidential Data shall not be permitted.
  5. SECURITY PRACTICES: Confidential Data provided to Town by the School District will be stored [insert location]. The measures that Town takes to protect Confidential Data will align with the NIST Cybersecurity Framework including, but not necessarily limited to, disk encryption, file encryption, firewalls, and password protection.
  6. ENCRYPTION PRACTICES: The Town will apply encryption to the Confidential Data while in motion and at rest at least to the extent required by Education Law Section 2-d and other applicable law.
DATA SECURITY AND PRIVACY PLAN

WHEREAS, the Fayetteville-Manlius Central School District (hereinafter “School District”) and Town of Manlius (hereinafter “Contractor”) entered into an agreement dated 9-18-2020 (hereinafter “Agreement”) for a School Information Resource Officer (hereinafter “Services”).

WHEREAS, pursuant to the requirements under 8 NYCRR 121, Contractor maintains the data security and privacy plan described herein in connection with the Services provided to the School District.

  1. During the term of the Agreement, Contractor will implement all state, federal and local data security and privacy requirements, consistent with the School District’s Data Security and Privacy Policy in the following way(s):
    • Utilizing a password protected, Virtual Private Network (VPN) with industry standard encryption.
  2. Contractor has in place the following administrative, operational and technical safeguards and practices to protect personally identifiable information that it will receive under the Agreement:
    • Mandatory 90-day password reset for each user. VPN with industry standard encryption. Industry standard firewall in place and updated as needed. Active directory auditing to monitor for potential breaches.
  3. Contractor shall comply with 8 NYCRR 121 in that it acknowledges that it has reviewed the School District’s Parents Bill of Rights for Data Privacy and Security and will comply with same.

a. Contractor will use the student data or teacher or principal data only for the exclusive purposes defined in the Agreement.

b. Contractor will ensure that the subcontractor(s) or other authorized
persons or entities to whom Contractor will disclose the student data or
teacher and principal data, if any, will abide by all applicable data  protection and security requirements as described in the “Supplemental Information” appended to the Agreement.

c. At the end of the term of the Agreement, Contractor will destroy, transition or return, at the direction of the School District, all student data and all teacher and principal data in accordance with the “Supplemental Information” appended to the Agreement.

d. Student data and teacher and principal data will be stored in accordance with the “Supplemental Information” appended to the Agreement.

e. Student data and teacher and principal data in motion and at rest will be protected using an encryption method that meets the standards described in 8 NYCRR 121.

4. Prior to receiving access to student data and/or teacher and principal data, officer(s) and employee(s) of Contractor and any assignees who will have access to student data or teacher or principal data shall receive training on the federal and state laws governing confidentiality of such data. Such training shall be provided:
Specify date of each training

    • Town of Manlius Police Department will provide training to the Officers on industry standard computer security protocols in order to prevent unauthorized access.

5. Subcontractors (check one):

__ Contractor shall not utilize sub-contractors.

X Contractor shall utilize sub-contractors. Contractor shall manage the relationships and contracts with such sub-contractors in the following ways in order to ensure personally identifiable information is protected:

        • Before a sub-contractor is brought in to support the efforts of the Town of Manlius Police Department in its role of providing services to the FM Schools, background checks will be conducted for each individual prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.
        • Additionally, a Business Associates’ Agreement (BAA) will be presented to and signed by all sub-contractors prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.

6. Contractor has the following procedures, plans or protocols in place to  manage data security and privacy incidents that implicate personally identifiable information:
Procedures, plans or protocols must, at a minimum, specify plans to identify breaches and unauthorized disclosures, and to promptly notify the School District.

    • 24-hour monitoring of servers by IT provider to identify unauthorized access. If a breach is detected a procedure is in place to notify applicable administrators so that applicable accounts can be shut down to prevent further access.

7. Termination of Agreement.

a. Within ___ days of termination of the Agreement, Contractor shall delete
or destroy all student data or teacher or principal data in its possession; AND

b. Within ___ days of termination of the Agreement, Contractor shall
Return all data to the School District using _________; OR

X Transition all data to a successor contractor designated by the School
District in writing:

    • The Town of Manlius Police Department does not retain any data that is outside of a police report. SIROs/SPOs may access the data but it is “view Only” and not retained by the department. Data may be used in a police report. The destruction of police reports is governed by the New York State Archives Records Retention and Disposition Schedule.

8. In the event of a conflict between the terms of this Data Security and Privacy Plan and the terms of the Agreement, the terms of this Data Security and Privacy Plan shall control. All of the defined terms in the Agreement shall have the same definitions in the Data Security and Privacy Plan, unless otherwise defined herein. Except as expressly set forth in this Data Security and Privacy Plan, the terms and conditions of the Agreement shall remain unmodified and in full force and effect.

IN WITNESS WHEREOF, the Contractor hereto has executed this Data Security and Privacy Plan as of Aug. 9, 2021.

Contractor: Edmond J. Theobald, Town Supervisor


SIRO Program 2024-25 (A. Palmer)

THIS AGREEMENT is made this 8th day of May, 2024, by and between the TOWN OF MANLIUS POLICE DEPARTMENT (hereinafter “POLICE DEPARTMENT”) and the FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT (hereinafter “SCHOOL DISTRICT”) as follows:

WHEREAS, the SCHOOL DISTRICT wishes to implement a SCHOOL INFORMATION RESOURCE OFFICER to promote the goal of ensuring a caring, safe, respectful, and orderly learning environment in its schools; and

WHEREAS, the SCHOOL DISTRICT and the POLICE DEPARTMENT desire to establish the terms and scope of duties in this SCHOOL INFORMATION and RESOURCE OFFICER (hereinafter referred to as (“SIRO”) Agreement the specific terms and conditions of the services to be provided by the said SIROs in the SCHOOL DISTRICT:

NOW, THEREFORE, THE PARTIES HERETO AGREE AS FOLLOWS:

Defined terms

For the purposes of this Agreement, the following terms have the meanings listed:
SIRO Supervisor – The POLICE DEPARTMENT employee assigned to supervise the SIRO’s activities.

School Liaison – The SCHOOL DISTRICT employee who is designated as the primary contact for the SIRO and POLICE DEPARTMENT regarding the SIRO’s work.

School Grounds – The school grounds shall consist of all buildings and grounds under jurisdiction of the SCHOOL DISTRICT, including but not limited to the high school, the middle school, the elementary school and the school district offices.

1.0 Goals and Objectives

It is understood and agreed that the SCHOOL DISTRICT and the POLICE DEPARTMENT officials share the following goals and objectives regarding the SIRO Program in the schools:

1.1 The primary duty of the SIRO is to establish relationships with students and to act as a mentor. The SIRO’s law enforcement function is a part of relationship-building with the student body and community.

1.2 The SIRO will foster educational programs and activities that increase student knowledge of and respect for the law and the function of law enforcement agencies;

1.3 The SIRO will be available to work cooperatively with teachers to assist in developing specialty programs specific to areas of study including but not limited to court procedures, citizenship and forensic science;

1.4 The SIRO will conduct criminal investigations with the goals of promoting safety for the school community and establishing a deterrent to delinquent student behavior and promoting and ensuring the safety of the students, faculty and administration of the SCHOOL DISTRICT;

1.5 The SIRO will work with school administrators to identify and address safety issues within the schools;

1.6 The SIRO will serve as a mentor and role model for students attending school in the SCHOOL DISTRICT.

2.0 Employment and Assignment of School Resource Officers

2.1 The SIRO shall be an employee of the POLICE DEPARTMENT and shall be subject to the administration, supervision and control of the POLICE DEPARTMENT, except as such administration, supervision and control is subject to the terms and conditions of this Agreement.

2.2 The POLICE DEPARTMENT agrees to provide and to pay the SIRO’s salary and employment benefits in accordance with the applicable salary schedules and employment practices of the POLICE DEPARTMENT. The SIRO shall be subject to all other personnel and practices of the POLICE DEPARTMENT except as such policies or practices may have to be modified to comply with the terms and conditions of this Agreement.

2.3 The parties shall use a collaborative process in the assignment of a SIRO. Both parties shall have the right to attend and participate in candidate interviews. The POLICE DEPARTMENT shall select three finalists from the candidate pool and the SCHOOL DISTRICT shall select the candidate to be assigned.

2.4 The POLICE DEPARTMENT shall notify the SCHOOL DISTRICT within 24 hours of the termination of the services of a SIRO assigned to the SCHOOL DISTRICT. The SCHOOL DISTRICT has the right to refuse the services of a particular SIRO and shall provide the POLICE DEPARTMENT with 24 hours notice of its intent to do so. Upon such notice by either party, the parties shall meet and confer within 48 hours of such notice to discuss the replacement of the SIRO.

2.5 The POLICE DEPARTMENT shall hold the SCHOOL DISTRICT free, harmless and indemnified from and against any and all claims, suits or causes of action arising out of allegations of unfair or unlawful employment practices bought by SIROs.

2.6 In the event an SIRO is absent from work, the SIRO shall notify both his supervisor in the POLICE DEPARTMENT and the principal of the school to which the SIRO is assigned on that particular day. To the extent possible, the POLICE DEPARTMENT shall provide an interim replacement.

2.7 The relationship of the POLICE DEPARTMENT to the SCHOOL DISTRICT shall be that of independent contractor and neither party shall be an agent of or otherwise have authority to bind the other party.

3.0 Payment Terms and Duty Hours

3.1 The SIRO’s regular duty shall be 40 hours per week for 186 days, and the schedule of these hours shall be set by mutual agreement between the SCHOOL DISTRICT and the POLICE DEPARTMENT. The SCHOOL DISTRICT may contract for additional service days beyond the required 186 days at the per diem rate.

3.2 The SCHOOL DISTRICT shall pay the POLICE DEPARTMENT for the services of SIRO OFFICER PALMER at an average per diem rate of $806.40 for the calendar year of 2024 and a per diem rate of $861.57 for the calendar year of 2025 for the 2024-25 school year. The SCHOOL DISTRICT will pay the POLICE DEPARTMENT at this per diem rate based upon the actual service of SIRO OFFICER PALMER.

3.3 From time to time the SIRO may be required to work more than the 8 hours of regular scheduled duty in a given day. The SIRO has the equal right of first refusal (with the SPOs assigned to the district) on overtime earning opportunities. In such instances of overtime, the additional time worked by the SIRO shall be credited as “school comp time” or overtime. The choice of either school comp time or overtime shall be at the discretion of the SIRO. School comp time may be used to offset days where the SIRO is scheduled to work, but does not have to report due to the closing of school. The maximum amount of comp time that may accumulate at any one time is 40 hours. At the end of the school year, any school comp time that has not been utilized by the SIRO shall be converted to overtime or carried forward into the next school year based upon the SIRO’s request. Authorized overtime for SIRO OFFICER PALMER shall be billed at a rate of $89.02 per hour for the calendar year of 2024 and $96.63 for the calendar year of 2025 for the 2024-25 school year.

3.4 The SIRO shall be on duty upon the school grounds fifteen minutes before the beginning of the student instructional day and shall remain on duty for eight (8) hours unless this schedule modified by the mutual agreement between the POLICE DEPARTMENT and the SCHOOL DISTRICT, or the Principal of the building to which the SIRO is assigned on a given day.

3.5 It is understood and agreed that time spent by the SIRO attending court juvenile and/or criminal cases arising from and/or out of their employment as an SIRO shall be considered as hours worked under this Agreement.

3.6 In the event of an emergency the SIRO may be ordered by the POLICE DEPARTMENT to leave school grounds during normal duty hours as described above to perform other services for the POLICE DEPARTMENT. In such instances, the time spent by the SIRO away from the school grounds shall not be considered billable time by the POLICE DEPARTMENT.

3.7 For school vacations, holidays and other times when school is not in session and/or the SIRO is not required to be on school grounds, the officer may take available leave balances, or report to the SIRO supervisor for reassignment.

4.0 Basic Qualifications of the School Information and Resource Officers (SIRO)

To be an SIRO, an officer must first meet all of the following basic qualifications:

4.1 Shall be a sworn officer and should have a minimum of five years of law enforcement experience;

4.2 Shall possess a sufficient knowledge of the applicable Federal and State laws, Town and County ordinances, and Board of Education policies and regulations;

4.3 Shall be capable of conducting in depth criminal investigations;

4.4 Shall possess even temperament and set a good example for students; and

4.5 Shall possess communication skills that would enable the officer to function effectively within the school environment.

5.0 Duties of School Resource Officer

5.1 To assist school officials with the enforcement of Board of Education Policies and Administrative Regulations regarding student conduct and to provide usual and customary police services to the SCHOOL DISTRICT. The role of school discipline shall remain with the school district administration.

5.2 To counsel public school students in special situations when requested by the principal or the principal’s designee or by the parents of a student;

5.3 To answer questions and conduct classroom presentations for students in law-related fields;

5.4 To perform such other duties as the parties may agree from time to time.

5.5 The SIRO shall not detain or question students regarding their immigration status.

6.0 Chain of Command

6.1 As employees of the POLICE DEPARTMENT, the SIRO shall follow the chain of command as set forth in the POLICE DEPARTMENT Policies and Procedure Manual, except where such procedures conflict with the policies of the Board of Education of the SCHOOL DISTRICT. It is expressly recognized and acknowledged by the SCHOOL DISTRICT that policies of the Board of Education cannot supersede the SIRO’s duty to act in accordance with state and federal law.

6.2 In the performance of the duties described herein, the SIRO shall regularly coordinate and communicate with the principal or the principals’ designee of the schools to which they are assigned. The principal or designee shall contact the SIRO Supervisor assigned by the POLICE DEPARTMENT for such purpose in the event of any question regarding the performance of duties by an SIRO.

7.0 Training/Briefing

7.1 The SIRO may be required by the POLICE DEPARTMENT to attend monthly training and briefing sessions. These sessions will be held at the direction of the POLICE DEPARTMENT Operations commander. Briefing Sessions will be conducted to provide for the exchange of information between the department and the school liaison.

7.2 The SCHOOL DISTRICT and the POLICE DEPARTMENT shall schedule training for the SIRO in Board of Education Policies, regulations and procedures, including the Code of Conduct for students and others and the programs and practices of the SCHOOL DISTRICT regarding student discipline.

8.0 Dress Code

8.1 The SIRO shall work primarily in either a departmental issued uniform or plain clothes business attire while on duty. The decision regarding the attire to be worn shall be made in consultation between the parties.

9.0 Supplies and Equipment

9.1 Motor vehicles. The POLICE DEPARTMENT shall provide a vehicle for the SIRO. Beginning in 2017, newly assigned vehicles shall be marked in the same manner as patrol vehicles assigned to the Field Services Section. There will be a yearly fee of $3,500 for the vehicle, payable to the Town.

9.2 Office Supplies. The SCHOOL DISTRICT agrees to provide each SIRO with the usual and customary office supplies and forms required in the performance of their duties. In addition, the SIRO shall be provided a private office within the school that is accessible by the students. The SIRO shall also be provided by the SCHOOL DISTRICT a computer, printer and access to a private fax machine for confidential intelligence sharing with other POLICE DEPARTMENT personnel, and a communication device.

9.3 Body Worn Camera (BWC): Body worn cameras are a common law enforcement tool and are utilized by all TMPD patrol officers. A BWC will be utilized by the SIRO; in the school setting the SIRO shall have the discretion to record contacts when they consider it to be in the best interest of the student, staff, school administrators or the SIRO.

10.0 Transporting Students

10.1 It is agreed that SIROs shall not transport students in their vehicles except when the students are victims of a crime, under arrest, or some other emergency circumstance exists.

10.2 If circumstances other than an arrest require that the SIRO transport a student, then an effort shall be made to have a school administrator shall accompany the officer and the student in the vehicle. When a school administrator is not available the SIRO shall record the transport using a body worn camera.

10.3 Students shall not be transported to any location unless it is determined that the student’s parent, guardian or custodian is at the destination to which the student is being transported. The SIRO shall not transport students in their personal vehicles.

10.4 The SIRO shall notify the building principal before moving a student from the school grounds.

11.0 Access to Education Records

11.1 School officials shall allow SIROs to inspect and copy any public records maintained by the school that is permissible by law.

11.2 If some information in a student’s cumulative record is needed in an emergency to protect the health or safety of the student or other individuals, school officials may disclose to the SIRO that information which is needed to respond to the emergency situation based on the seriousness of the threat to someone’s health or safety; the need of the information to meet the emergency situation and the extent to which time is of the essence.

11.3 If confidential student records information is needed, but no emergency situation exists, the information may be released only upon the issuance of a search warrant or subpoena to produce the records, or as may otherwise comply with the Family Educational Rights and Privacy Act (FERPA).

11.4 Pursuant to FERPA, the SCHOOL DISTRICT hereby designates each SIRO as the District’s “law enforcement unit” for the purpose of enforcing any Federal, State or local law and maintaining the physical security and safety of the schools to which they are assigned, and as such shall have access to student education records as appropriate in order to carry out their SIRO duties.

12.0 Term of Agreement

12.1 The term of this agreement is one year commencing on July 1, 2024 and ending on June 30, 2025. The Agreement may be renewed and extended annually by the written agreement of both the SCHOOL DISTRICT and the POLICE DEPARTMENT. Written notice of intent to extend the Agreement must be sent by each party no later than June 1st of the current year.

12.2 In the event that the SCHOOL DISTRICT opts not to extend the Agreement in a given year, it shall remain responsible to pay the per diem charges that would otherwise have been due for the months of September and October of the succeeding year.

13.0 Insurance and Indemnification

13.1 The POLICE DEPARTMENT shall maintain in full force and effect during the term of this Agreement a comprehensive liability insurance policy with coverage that is consistent with police department policies and procedures.

13.2 Without waiving any defenses, the POLICE DEPARTMENT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the SCHOOL DISTRICT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. The SCHOOL DISTRICT shall provide notice to the POLICE DEPARTMENT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the SCHOOL DISTRICT, would cause the SCHOOL DISTRICT to suffer or incur loss or expense.

13.3 Without waiving any defenses, the SCHOOL DISTRICT agrees to, at its sole cost and expense, indemnify, protect, defend and hold the POLICE DEPARTMENT harmless against any and all damages, losses, liabilities, obligations, penalties, claims, litigation, demands, defenses, judgments, suits, actions, proceedings, costs, disbursements and/or expenses (including reasonable attorney’s fees) arising out of the performance of the SIRO’s authorized duties as described in this Agreement. POLICE DEPARTMENT shall provide notice to the SCHOOL DISTRICT within twenty (20) days of obtaining the same, of any potential claim or action which, if decided adversely to the POLICE DEPARTMENT, would cause the POLICE DEPARTMENT to suffer or incur loss or expense.

14.0 Evaluation

It is mutually agreed that the SCHOOL DISTRICT shall annually evaluate the SIRO Program and the parties agree that an exchange of data related to the SIRO’s performance shall be a part of the annual evaluation process.

15.0 Protection of Confidential Data

The Town shall provide their Services in a manner which protects Student Data (as defined by 8 NYCRR 121.1(q)) and Teacher or Principal Data (as defined by 8 NYCRR 121.1(r)) (hereinafter “Confidential Data”) in accordance with the requirements articulated under Federal, New York State and local laws and regulations, including but not limited to the foregoing:

(a) The Town will adopt technologies, safeguards and practices that align with the NIST Cybersecurity Framework.

(b) The Town will comply with the School District Data Security and Privacy Policy, Education Law § 2-d, and 8 NYCRR §121.

(c) The Town will limit internal access to personally identifiable information to only those employees or sub-contractors that need access to provide the contracted services.

(d) The Town will not use the personally identifiable information for any purpose not explicitly authorized in this Agreement.

(e) The Town will not disclose any personally identifiable information to any other party without the prior written consent of the parent or eligible student, unless otherwise authorized pursuant to applicable law.

(f) The Town will maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of personally identifiable information in its custody.

(g) The Town will use encryption to protect personally identifiable information in its custody while in motion or at rest.

(h) The Town will not sell personally identifiable information nor use or disclose it for any marketing or commercial purpose or facilitate its use or disclosure by any other party for any marketing or commercial purpose or permit another party to do so.

(i) In the event the Town engages a subcontractor to perform their contractual obligations, the data protection obligations imposed on the Town shall apply to the subcontractor.

16.0 Data Breach

In the event that Confidential Data is accessed or obtained by an unauthorized individual, the Town shall provide notification to the School District without unreasonable delay and not more than seven calendar days after the discovery of such breach. The Town shall follow the following process:

(a) The security breach notification shall be titled “Notice of Data Breach,” shall be clear, concise, use language that is plain and easy to understand, and to the extent available, shall include: a brief description of the breach or unauthorized release; the dates of the incident in the date of discovery; a description of the types of Confidential affected; an estimate of the number of records affected; a brief description of the Town’s investigation or plan to investigate; and contact information for representatives who can assist the School District with additional questions.

(b) The Town shall also prepare a statement for parents and eligible students which provides information under the following categories: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information.”

(c) Where a breach or unauthorized release of Confidential Data is attributed to Contractor, and/or a subcontractor or affiliate of the Town, The Town shall pay for or promptly reimburse the School District for the cost of notification to parents and eligible students of the breach.

(d) The Town shall cooperate with the School District and law enforcement to protect the integrity of investigations into the breach or unauthorized release of Confidential Data.

i. The name and contact information of the reporting School District subject to this section.

ii. A list of the types of personal information that were or are reasonably believed to have been the subject of a breach.

iii. If the information is possible to determine at the time the notice is provided, then either (1) the date of the breach, (2) the estimated date of the breach, or (3) the date range within which the breach occurred. The notification shall also include the date of the notice.

iv. Whether the notification was delayed as a result of a law enforcement investigation, if that information is possible to determine at the time the notice is provided.

v. A general description of the breach incident, if that information is possible to determine at the time the notice is provided.

vi. Information about what the agency has done to protect individuals whose information has been breached.

vii. Advice on steps that the person whose information has been breached may take to protect himself or herself.

(e) The Town further acknowledges and agrees to have a written incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of Protected Data or any portion thereof, and agrees to provide Client, upon request, with a copy of said written incident response plan.

IN WITNESS WHEREOF, the parties hereto have caused this Operations Agreement to be executed the day and year first written above.

FAYETTEVILLE-MANLIUS CENTRAL SCHOOL DISTRICT
Dr. Craig Tice, Superintendent of Schools

MANLIUS POLICE DEPARTMENT
Michael Crowell, Chief of Police

TOWN OF MANLIUS
Edmond Theobald, Town Supervisor

Addendum A

PARENTS’ BILL OF RIGHTS FOR DATA PRIVACY AND SECURITY

Fayetteville-Manlius is committed to ensuring student privacy in accordance with local, state and federal regulations and district policies. To this end and pursuant to U.S. Department of Education (DOE) regulations (Education Law §2-d), the district is providing the following Parents’ Bill of Rights for
Data Privacy and Security:

  • A student’s personally identifiable information cannot be sold or released for any commercial or marketing purposes.
  • Parents have the right to inspect and review the complete contents of their child’s education record, including any student data maintained by the Fayetteville-Manlius School District. This right of inspection of records is consistent with the federal Family Educational Rights and Privacy Act (FERPA). Under the more recently adopted regulations (Education Law §2-d), the rights of inspection are extended to include data, meaning parents have the right to inspect any data in their child’s educational record. The New York State Education Department (SED) will develop further policies and procedures related to these rights in the future.
  • State and federal laws protect the confidentiality of personally identifiable information and safeguards associated with industry standards and best practices, including but not limited to, encryption, firewalls and password protection, must be in place when data is stored or transferred.
  • A complete list of all student data elements collected by the state is available for public review in an Excel file at
    http://www.p12.nysed.gov/irs/sirs/documentation/NYSEDstudentData.xlsx.
  • Parents may also obtain a copy of this list by writing to the Office of Information & Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, N.Y. 12234.
  • Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be directed to: Mary Coughlin, Assistant Superintendent for Instruction, Fayetteville-Manlius School District, 8199 E. Seneca Turnpike, Manlius, NY 13104. Complaints to SED should be directed to: Chief Privacy Officer, New York State Education Department, 89
    Washington Avenue, Albany, NY 12234; the e-mail address is cpo@mail.nysed.gov.

Addendum B

PARENTS’ BILL OF RIGHTS – SUPPLEMENTAL INFORMATION ADDENDUM
  1. EXCLUSIVE PURPOSES FOR DATA USE: The exclusive purposes for which “student data” or “teacher or principal data” (as those terms are defined in Education Law Section 2-d and collectively referred to as the “Confidential Data”) will be used by Town of Manlius and the Town of Manlius Police Department (referred to jointly as the “Town”) are limited to the purposes authorized in the contract between the Town and the Fayetteville-Manlius Central School District (the “School District”) commencing on July 1, 2021 and expiring on June 30, 2022 (the “Contract”).
  2. SUBCONTRACTOR OVERSIGHT DETAILS: The Town will ensure that any subcontractors, or other authorized persons or entities to whom the Town will disclose the Confidential Data, if any, are contractually required to abide by all applicable data protection and security requirements, including but not limited to those outlined in applicable state and federal laws and regulations (e.g., Family Educational Rights and Privacy Act (“FERPA”); Education Law §2-d; 8 NYCRR Part 121).
  3. CONTRACT PRACTICES: The Contract commences and expires on the dates set forth in the Contract, unless earlier terminated or renewed pursuant to the terms of the Contract. On or before the date the Contract expires, protected data will be exported to the School District in [insert data format] format and/or destroyed by the Town as directed by the School District.
  4. DATA ACCURACY/CORRECTION PRACTICES: A parent or eligible student can challenge the accuracy of any “education record”, as that term is defined in the FERPA, stored by the School District in a Town’s product and/or service by following the School District’s procedure for requesting the amendment of education records under the FERPA. Teachers and principals may be able to challenge the accuracy of APPR data stored by School District in Town’s product and/or service by following the appeal procedure in the School District’s APPR Plan. Unless otherwise required above or by other applicable law, challenges to the accuracy of the Confidential Data shall not be permitted.
  5. SECURITY PRACTICES: Confidential Data provided to Town by the School District will be stored [insert location]. The measures that Town takes to protect Confidential Data will align with the NIST Cybersecurity Framework including, but not necessarily limited to, disk encryption, file encryption, firewalls, and password protection.
  6. ENCRYPTION PRACTICES: The Town will apply encryption to the Confidential Data while in motion and at rest at least to the extent required by Education Law Section 2-d and other applicable law.
DATA SECURITY AND PRIVACY PLAN

WHEREAS, the Fayetteville-Manlius Central School District (hereinafter “School District”) and Town of Manlius (hereinafter “Contractor”) entered into an agreement dated 8-9-2021 (hereinafter “Agreement”) for a School Information Resource Officer (hereinafter “Services”).

WHEREAS, pursuant to the requirements under 8 NYCRR 121, Contractor maintains the data security and privacy plan described herein in connection with the Services provided to the School District.

  1. During the term of the Agreement, Contractor will implement all state, federal and local data security and privacy requirements, consistent with the School District’s Data Security and Privacy Policy in the following way(s):
    • Utilizing a password protected, Virtual Private Network (VPN) with industry standard encryption.
  2. Contractor has in place the following administrative, operational and technical safeguards and practices to protect personally identifiable information that it will receive under the Agreement:
    • Mandatory 90-day password reset for each user. VPN with industry standard encryption. Industry standard firewall in place and updated as needed. Active directory auditing to monitor for potential breaches.
  3. Contractor shall comply with 8 NYCRR 121 in that it acknowledges that it has reviewed the School District’s Parents Bill of Rights for Data Privacy and Security and will comply with same.

a. Contractor will use the student data or teacher or principal data only for the exclusive purposes defined in the Agreement.

b. Contractor will ensure that the subcontractor(s) or other authorized
persons or entities to whom Contractor will disclose the student data or
teacher and principal data, if any, will abide by all applicable data  protection and security requirements as described in the “Supplemental Information” appended to the Agreement.

c. At the end of the term of the Agreement, Contractor will destroy, transition or return, at the direction of the School District, all student data and all teacher and principal data in accordance with the “Supplemental Information” appended to the Agreement.

d. Student data and teacher and principal data will be stored in accordance with the “Supplemental Information” appended to the Agreement.

e. Student data and teacher and principal data in motion and at rest will be protected using an encryption method that meets the standards described in 8 NYCRR 121.

4. Prior to receiving access to student data and/or teacher and principal data, officer(s) and employee(s) of Contractor and any assignees who will have access to student data or teacher or principal data shall receive training on the federal and state laws governing confidentiality of such data. Such training shall be provided:
Specify date of each training

    • Town of Manlius Police Department will provide training to the Officers on industry standard computer security protocols in order to prevent unauthorized access.

5. Subcontractors (check one):

__ Contractor shall not utilize sub-contractors.

X Contractor shall utilize sub-contractors. Contractor shall manage the relationships and contracts with such sub-contractors in the following ways in order to ensure personally identifiable information is protected:

        • Before a sub-contractor is brought in to support the efforts of the Town of Manlius Police Department in its role of providing services to the FM Schools, background checks will be conducted for each individual prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.
        • Additionally, a Business Associates’ Agreement (BAA) will be presented to and signed by all sub-contractors prior to authorizing their access to the Town of Manlius Police Department network and resources or to the FD School facilities, IT resources or PII.

6. Contractor has the following procedures, plans or protocols in place to  manage data security and privacy incidents that implicate personally identifiable information:
Procedures, plans or protocols must, at a minimum, specify plans to identify breaches and unauthorized disclosures, and to promptly notify the School District.

    • 24-hour monitoring of servers by IT provider to identify unauthorized access. If a breach is detected a procedure is in place to notify applicable administrators so that applicable accounts can be shut down to prevent further access.

7. Termination of Agreement.

a. Within ___ days of termination of the Agreement, Contractor shall delete
or destroy all student data or teacher or principal data in its possession; AND

b. Within ___ days of termination of the Agreement, Contractor shall
Return all data to the School District using _________; OR

X Transition all data to a successor contractor designated by the School
District in writing:

    • The Town of Manlius Police Department does not retain any data that is outside of a police report. SIROs/SPOs may access the data but it is “view Only” and not retained by the department. Data may be used in a police report. The destruction of police reports is governed by the New York State Archives Records Retention and Disposition Schedule.

8. In the event of a conflict between the terms of this Data Security and Privacy Plan and the terms of the Agreement, the terms of this Data Security and Privacy Plan shall control. All of the defined terms in the Agreement shall have the same definitions in the Data Security and Privacy Plan, unless otherwise defined herein. Except as expressly set forth in this Data Security and Privacy Plan, the terms and conditions of the Agreement shall remain unmodified and in full force and effect.

IN WITNESS WHEREOF, the Contractor hereto has executed this Data Security and Privacy Plan as of 8-9-2021.

Contractor: Edmond J. Theobald, Town Supervisor