A new election data transparency law that took effect on April 1 will reshape how school districts collect, transmit and preserve voting records.
The Dr. John L. Flateau Voting & Elections Database of New York Act (Election Law section 3 112) will create a centralized, statewide database with election information from every jurisdiction in the state. The Legislature’s stated goal is to enhance public access, support detailed analyses of electoral administration and promote consistency in electoral recordkeeping.
The law is named after a member of New York’s Independent Redistricting Commission who died in 2023 at age 73. Dr. Flateau was the lead plaintiff in a federal lawsuit, Flateau v. Anderson, that succeeded in requiring the New York Legislature to redraw its districts after the 1980 U.S. Census.
The Flateau law poses three challenges for school districts:
- What steps must district clerks or other school personnel take to be in full compliance with the law?
- How can school districts protect the confidentiality of voter data?
- How will school districts be affected by the comparisons that can be made on capital expenditures, voter turnout and other metrics that can be made using the new state database?
Complying with new requirements
Until recently, school district elections were governed exclusively by state Education Law. The creation of the Dr. John L. Flateau Voting & Elections Database makes the schools accountable under new reporting provisions of state Election Law.
The law only requires school districts (and other election authorities) to comply if they have the capability of maintaining the records required. It remains unclear how a school district that wishes to be exempted would do so; regulatory guidance is expected by October.
The statutory obligations are extensive and detailed. After the certification of each election, every school district that administers its own elections must transmit specific records to the state Board of Elections within 10 business days or by Jan. 1, whichever is later.
Records that must be submitted include district-level election results for every race administered by the district, contemporaneous voter registration lists and voter history files documenting voter participation in previous elections.
Districts must also provide maps or other documentation showing the configurations of election districts. Such maps or documentation must be in a format to be prescribed by the Board of Elections.
Notably, the new law requires detailed tabulations concerning affidavits and absentee ballots. Districts must report the number of valid and invalid ballots and the reasons for invalidation. Lists of election day and early voting poll sites, as well as maps showing which districts are assigned to each site, must also be included. In addition, school districts will be required to transmit any adopted districting or redistricting plans.
Powers of the Board of Elections
The Board of Elections may request additional publicly available data already maintained by the district, but school districts are not required to create new records that they do not already possess.
Also, the law includes robust enforcement mechanisms. Every six months, the Board of Elections must identify school districts that have failed to meet the requirements clearly set forth by the new law. Such entities will be granted a “cure period” of 10 business days to comply or provide a valid explanation for their failure to submit the required election records.
If the school district fails to take corrective action, the Board of Elections or the State Attorney General may bring enforcement actions to ensure compliance with the statute.
The law authorizes the Board of Elections to promulgate regulations to aid in implementation. Such regulations are expected to align with national guidelines set forth by federal agencies such as the National Institute of Standards and Technology, the Election Assistance Commission and the Cybersecurity and Infrastructure Security Agency.
How school districts can protect voter privacy Under these new requirements, all records transmitted to the state Board of Elections must be posted to a public facing website within 60 days of receipt. However, for the sake of voter data privacy, individual voter registration records are explicitly excluded from online publication. Instead, members of the public may only access such records through the Freedom of Information Law (FOIL) or other existing Election Law procedures.
When districts receive a FOIL request, personnel should carefully evaluate each request and redact any personal details. District officials should consult legal counsel if the FOIL request appears overly broad or otherwise seems inconsistent with the public’s right to know.
Although the Flateau law emphasizes transparency, it also raises data privacy concerns. One effective strategy for protecting sensitive voter data is to limit the data collected. Because the statute does not require election authorities to create records that they do not already maintain, districts should review their election-related procedures to ensure they are gathering only essential information. Minimizing the volume of personally identifiable information reduces the risk of potential inadvertent disclosure of sensitive information.
Of course, school districts should implement strict internal controls. Districts should only allow authorized personnel to handle voter registration files, voter history records or ballot processing documentation. Typically, this individual will be the district clerk or records access officer.
To maintain strong internal controls, school districts should use access logs, require supervisory approval for the export of particularly sensitive data and restrict digital permissions. Digital files should always be encrypted and any physical records maintained by school districts should be kept in locked, monitored locations until they are transferred or destroyed. Review your district’s policies and procedures on data handling.
Any individual responsible for election administration should receive ongoing training in cybersecurity, data privacy best practices and FOIL compliance. Preparing now will help districts adapt smoothly once the Board of Elections issues its implementing regulations. As districts begin to implement these new voter data privacy practices, districts should conduct periodic privacy and risk assessments to help identify any vulnerabilities before they lead to breaches. Auditing data flows, reviewing retention practices and evaluating cybersecurity controls will help school districts create a strong privacy protection framework.
Members of the New York State Association of School Attorneys represent school boards and school districts. This article was prepared by the 25-member education law team at Hodgson Russ LLP, headed by Jeffrey F. Swiatek.