Statement on the NYS Comptroller’s audit of NYC’s Privacy and Security of Student Data

For immediate release: May 4, 2026

For more information: Leonie Haimson, leonie@classsizematters.org; 917-435-9329 

The audit from the State Comptroller’s office released today confirms what many NYC advocates have long known:  the privacy policies and practices of the NYC Dept. of Education are sloppy, irresponsible and show a lack of concern for keeping students’ personal information safe from breach and misuse.    This makes DOE’s insistent push to rapidly expand the use of Artificial Intelligence tools in our schools unwarranted, given how these tools represent an even greater risk to student  privacy and safety.  

Even more troubling is the DOE contemptuous response to the auditors’ findings and recommendations to improve their processes, dismissing nearly each one as unfounded.  Altogether, the audit’s findings reinforce the lack of trust felt by many in DOE’s competence and caring when it comes to protecting student privacy. 

The audit’s findings put in question the AI guidance’s assurances on DOE’s ability to keep student data safe

In the recent DOE AI guidance, they repeat over and over that student privacy is rigorously protected through a vetting  process  called ERMA (Enterprise Request Management Application).   Yet the findings in this audit show that  DOE’s privacy processes are inherently defective.   The DOE’s lack of responsiveness and willingness to improve their privacy policies provide yet more evidence  that their rush to expand the use of AI in our schools is reckless.   AI products represent a special risk to student privacy as many  data-mine personal data to improve their products, which violates the state student privacy law, Ed Law 2D, the NY State Student Privacy law passed by the legislature in 2014. 

The audit’s findings, as well as repeated data breaches of NYC student data and its illegal use for commercial purposes reveal the inadequacy of the  DOE’s privacy vetting process.  As a member of the Chancellor’s AI Working Group, I along with other members proposed additional safeguards.  These included independent privacy impact assessments, data security audits, and tests for algorithmic bias that should be required for any educational product using AI.  DOE rejected all these recommendations.   Additional problems with the recently released AI guidance, including DOE’s refusal to rigorously comply with the state privacy law,  are described in our critique here. 

The findings confirm DOE’s failure to properly control and safeguard personal student information

The auditors discovered that DOE maintains  no central records as to which vendors and other third parties have access to student personal information, and that they maintain no written policies covering data classification, risk assessment, or backup and recovery, as required by the NIST data security framework specified by Ed Law 2D.  

In their response, DOE officials claim  that this conclusion is false, and that they are “able to determine which SIS or other applications that consume student data are in use by a given school or office.”  Yet just last week, on April 28, 2026, the DOE privacy office confirmed in an email to a parent that “at this time, there is no Central list of every educational technology tool used by each school.”  

Moreover, according to Ed Law 2D, it is every parent’s right to know which vendors have access to their children’s data, and to receive a copy of the data held by those vendors  within 45 days of their request. Yet this right is chronically  violated by DOE officials, and when parents do receive data files from their vendors, the files can be empty of information. 

There are more than 700  companies and other third parties that have access to personal student data according to the DOE website, though the number of the ed tech programs used is likely greater,  as some vendors provide schools with more than one product.   The number of products collecting and processing student data has steadily increased each year, and is even now even more rapidly growing, as DOE adds  new products with AI functionality to be used in classrooms throughout the city. 

Delays in recognizing and reporting breaches 

Because DOE officials do not know which schools use which products, they are unable to ensure that when data breaches occur, they are able to inform affected families within the legally required timeline or identify which data elements may have been exposed.

The auditors reported that there were at least 141 breaches of NYC personal student data  between January 5, 2023 through February 27, 2025, and in 48% of cases, the DOE reported them to  NYSED past the legal deadline of 10 days.  In at least one case, it took over 460 days.  DOE also missed the 60 day deadline to inform parents that their children’s data had been breached in at least 11% of the time. [Note: 60 days is in itself too long; NY law requires breach notification by private businesses  and state agencies within 30 days.]

 The Illuminate breach and problems with their privacy agreement

Some privacy vendor agreements are never even posted online in violation of the law - like that of Illuminate, which exposed the data of more than a million NYC current and former students in 2022, and yet whose privacy agreement was posted online only after the breach occurred.  Even then,  the agreement hinted that the data was not always encrypted, contrary to the requirements of the law, which turned out to be the case.  

The Illuminate example also shows that  DOE does not independently investigate breaches but instead relies on the unreliable reporting of vendors concerning the number and identity of students affected. After the data of more than 800,000 current and former NYC students was breached by Illuminate between late December 2021 and early January 2022, their families were not notified by DOE until March 25, 2022.  

Even worse, in May 2024, more than two years after the breach, a  second round of notifications to families revealed that about  380,000 more students and former students also had their information exposed.  This was also seven months after Illuminate had informed DOE of the additional students involved – far exceeding the 60 day deadline in the law, according to the information on the DOE website, which states that they started looking into this matter only after being told by Illuminate that more students were affected in October 2023.  This put additional students and former students at risk of identity theft and more, and unable to promptly acquire the insurance and credit monitoring offered by the vendor for free.

The PowerSchool breach and problems with their privacy agreement

After the massive nationwide breach of the PowerSchool student information system occurred in late December 2024,  parents throughout the country and elsewhere in the state were informed of the breach in early January 2025.  Yet at that time, DOE told a reporter they were still looking into whether any NYC schools or students were affected. 

In fact, DOE refused to confirm which schools were involved even after Daily News reported on their names  on February 6, 2025, from information relayed by the State Education Department.  Only after the Daily News reported on this did parents whose children attended these schools receive emails saying DOE was still looking into this matter.  It was not until April  2025  that DOE confirmed to parents that their children’s data had been breached, long past  the 60-day deadline in the law. 

To this day, the DOE has refused to post the names of the NYC schools affected by the PowerSchool breach on the webpage that reports on data security incidents, despite guidance from the NYSED that they should do so promptly, to alert the thousands of former students whose data was also exposed and put at risk of identity theft and worse. 

As the former NYSED Chief Privacy Officer Louise de Candia wrote on Feb.3, 2025, “ There is no doubt in my mind that PowerSchool violated Education Law Section 2-d and Part 121 of the regulations which require compliance with NIST CSF as well as reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of PII.”

And yet  DOE continues to allow NYC schools to use as many as 16 other privacy-invasive PowerSchool products, including Naviance, which is employed in many if not most New York high schools for college guidance purposes. This is despite the fact that in 2022, it was reported that Naviance  targeted ads for colleges on its student-facing platform disguised as objective recommendations and was shown to allow colleges to discriminate by race by targeting ads only to white students.

More recently, it was announced that PowerSchool had agreed to settle a class action lawsuit  alleging that the Naviance  platform contained ad tracking technology that transmitted a wide range of student data to Google, Microsoft and a company called Heap, including their names, ID numbers, graduation years,  demographic information, photographs and survey responses, as well as  their private communications with teachers.  This would violate not only state privacy laws but also the federal wiretapping statute.   Even now, the DOE has refused to tell parents or students about the Naviance agreement or  inform them they can apply for a portion of the $17.25 million settlement. 

The fact that the Illuminate and PowerSchool breaches exposed the data of many thousands of NYC students who had long graduated or otherwise left the system also shows that the data minimization and deletion by vendors required by Ed Lawa 2D is not enforced by DOE. More background here. 

To make things worse, the PowerSchool privacy agreement still posted on the DOE website is clearly non-compliant with the law, as it says that the company will only conform to the privacy requirements in federal and state law or in their contract with DOE when it is “commercially reasonable.”

Other problems highlighted in the audit and the DOE’s official response

The Comptroller’s office also found significant weaknesses in DOE’s technical data security controls that should be corrected, including “issues with system monitoring, unsupported systems, and firewalls.” Understandably, the auditors only communicated the details of these security weaknesses to DOE in a separate confidential report.  In their response, DOE makes no commitment to address these technical problems, but instead says that they would address them separately, within the confidential report.

In its response, DOE  claims to have made “several improvements to its privacy practices and policies,” including updating the Chancellor’s Regulation A-820 to “restrict the use of “directory information.”

In fact, the recent amendment to the Chancellor’s Regulation weakened the protections for student data, by redefining  a wide and essentially unlimited range of personal student information, including but not limited to their names, addresses, telephone numbers, email addresses, photographs, grade level, participation in activities and sports, and more, as directory data that can be shared with third parties, even when they are not providing services to schools.  Only an unreliable parent opt out  process was provided to prevent these disclosures from occurring.

Finally, the auditors also revealed that DOE officials took an inordinate time to respond to their requests; and that documentation requests took over five months to fulfill, while requests for meetings took two months  to schedule.  

Leonie Haimson is the co-chair of the Parent Coalition for Student Privacy, a member of the NYSED Data Privacy Advisory Committee, the Chancellor’s Data Privacy Working Group and the Chancellor’s AI Working Group

###

 

Unanswered questions about DESSA, the DOE's social-emotional screener, and what parents should do

One small section of the DESSA screener

UPDATE: If you decide to opt your child out of this screener, and haven't yet heard from your child's principal on how to do this,  email the principal and cc the parent coordinator telling them this, along with your name, your child's name, class and OSIS number; the deadline is Oct. 29.  The screenings starts next week. 

Along with the useless and time-consuming academic assessments that teachers have been told to administer this month, see here and here, teachers are also supposed to complete lengthy social-emotional assessments for each their students called DESSA, for Devereux Student Strengths Assessment, produced by a company called Aperture.  DOE purchased the use of this assessment for $18.17 million, according to Checkbook NYC, for three years according to the description on the PEP contract list, which voted to approve the contract in July. The description also says that "Aperture's program includes an intervention-tracking tool that offers specialized intervention recommendations, rather than a generic list," based upon a proprietary algorithm, one can only assume.

There are two different DOE webpages for parents about these assessments, here and here.  On this FAQ, it says that parents have the right to opt out.

DOE also sent the following message to principals, saying that parents can opt out, but unfortunately many parents have still not been alerted to this fact:

Copies of the lengthy DESSA  “screeners”  are available online.  Here is the lengthy form that teachers are supposed to fill out for students in Kindergarten through 8^th grade, and here is the one for high school students.

I wonder both how most teachers would be able to answer these questions with any certainty after only a few weeks of classes; it will also be very time consuming, especially for NYC middle and high school teachers, who sometimes have up to 160 students each (though only the attendance teacher is supposed to fill them out in middle and high schools, which generally is the 2nd or 3rd period teacher.)  

Here is an excerpt message to his union members from UFT President Michael Mulgrew, sent today:

In our last discussions with the DOE on the topic, school officials told us that most students would be screened in January and the screener would consist of only 5-7 questions — a manageable number — so that we could gauge how our students were doing as part of our normal workday.

Now, the DOE wants us to administer a screening that contains 43 questions, a sixfold increase over the original plan. We don’t think such a lengthy screening is necessary to identify which students need extra support, and we can’t allow another strenuous task to be added to our plates during a time like this when we are all at our limit.

Along with serious questions about how these screeners place excessive demands upon teachers to fill them out and how reliable their input will be, there are also real questions about the accuracy of the algorithm used to suggest interventions, and how private and secure the resulting data will be.

The company that owns DESSA is called Aperture, a for-profit LLC, headquartered in South Carolina with about 40 full-time employees.  If one reads the company’s privacy policy, it is not reassuring about the security of the personal student data that they collect and store.  Among other things, the Privacy Policy states that while financial payment information will be safely encrypted, it does not say the same thing about the student data (click on the box to enlarge):

According to the NY State student privacy law, Education Law §2-d,any online app or program utilized by NYC schools must be required to encrypt all personal student data in motion and in rest, so parents will have to get access to the contract to see if it complies with the law. 

We already know from this recent data breach that DOE is NOT safely storing student data.  More information about the very sensitive data Aperture collects is reported on a separate  privacy page for California users, in compliance with the California Consumer Privacy Act of 2018.  Among the data elements it contains:

Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

I strongly urge parents to demand the DOE contract with Aperture from DOE’s chief privacy policy, Joe Baranello, to see what actual data is being collected, with what third parties it is being shared, and how it is being secured. You can email him at studentprivacy@schools.nyc.gov. Access to all this information is also guaranteed under the law and is supposed to be posted on the DOE website here (but isn't).  

If you don’t get the contract, I strongly suggest that you opt out and file a complaint with the State's student privacy officer.  Contact us at info@studentprivacymatters.org if you want help.

The final important question is what will be done with this information if it is found through the screener that students are experiencing emotional distress.  On the PEP contract page, the DOE wrote "that the DESSA tool will help schools identify students ho might need additional social and emotional health supports, so that schools can ensure students have the access to the right services and are getting the help they need." 

But see the following observations from a NYC teacher:

She followed by saying that the guidance counselors and social worker at her school are already overstretched:

I followed up by asking if one of the main problems with all these assessments is not so much that teachers don’t know which of their students have learning or mental health needs, it is that schools do not have the capacity to address them because of large classes and a lack of staffing.   

This is how she responded: