Statement on the NYS Comptroller’s audit of NYC’s Privacy and Security of Student Data

For immediate release: May 4, 2025

For more information: Leonie Haimson, leonie@classsizematters.org; 917-435-9329 

The audit from the State Comptroller’s office released today confirms what many NYC advocates have long known:  the privacy policies and practices of the NYC Dept. of Education are sloppy, irresponsible and show a lack of concern for keeping students’ personal information safe from breach and misuse.    This makes DOE’s insistent push to rapidly expand the use of Artificial Intelligence tools in our schools unwarranted, given how these tools represent an even greater risk to student  privacy and safety.  

Even more troubling is the DOE contemptuous response to the auditors’ findings and recommendations to improve their processes, dismissing nearly each one as unfounded.  Altogether, the audit’s findings reinforce the lack of trust felt by many in DOE’s competence and caring when it comes to protecting student privacy. 

The audit’s findings put in question the AI guidance’s assurances on DOE’s ability to keep student data safe

In the recent DOE AI guidance, they repeat over and over that student privacy is rigorously protected through a vetting  process  called ERMA (Enterprise Request Management Application).   Yet the findings in this audit show that  DOE’s privacy processes are inherently defective.   The DOE’s lack of responsiveness and willingness to improve their privacy policies provide yet more evidence  that their rush to expand the use of AI in our schools is reckless.   AI products represent a special risk to student privacy as many  data-mine personal data to improve their products, which violates the state student privacy law, Ed Law 2D, the NY State Student Privacy law passed by the legislature in 2014. 

The audit’s findings, as well as repeated data breaches of NYC student data and its illegal use for commercial purposes reveal the inadequacy of the  DOE’s privacy vetting process.  As a member of the Chancellor’s AI Working Group, I along with other members proposed additional safeguards.  These included independent privacy impact assessments, data security audits, and tests for algorithmic bias that should be required for any educational product using AI.  DOE rejected all these recommendations.   Additional problems with the recently released AI guidance, including DOE’s refusal to rigorously comply with the state privacy law,  are described in our critique here. 

The findings confirm DOE’s failure to properly control and safeguard personal student information

The auditors discovered that DOE maintains  no central records as to which vendors and other third parties have access to student personal information, and that they maintain no written policies covering data classification, risk assessment, or backup and recovery, as required by the NIST data security framework specified by Ed Law 2D.  

In their response, DOE officials claim  that this conclusion is false, and that they are “able to determine which SIS or other applications that consume student data are in use by a given school or office.”  Yet just last week, on April 28, 2026, the DOE privacy office confirmed in an email to a parent that “at this time, there is no Central list of every educational technology tool used by each school.”  

Moreover, according to Ed Law 2D, it is every parent’s right to know which vendors have access to their children’s data, and to receive a copy of the data held by those vendors  within 45 days of their request. Yet this right is chronically  violated by DOE officials, and when parents do receive data files from their vendors, the files can be empty of information. 

There are more than 700  companies and other third parties that have access to personal student data according to the DOE website, though the number of the ed tech programs used is likely greater,  as some vendors provide schools with more than one product.   The number of products collecting and processing student data has steadily increased each year, and is even now even more rapidly growing, as DOE adds  new products with AI functionality to be used in classrooms throughout the city. 

Delays in recognizing and reporting breaches 

Because DOE officials do not know which schools use which products, they are unable to ensure that when data breaches occur, they are able to inform affected families within the legally required timeline or identify which data elements may have been exposed.

The auditors reported that there were at least 141 breaches of NYC personal student data  between January 5, 2023 through February 27, 2025, and in 48% of cases, the DOE reported them to  NYSED past the legal deadline of 10 days.  In at least one case, it took over 460 days.  DOE also missed the 60 day deadline to inform parents that their children’s data had been breached in at least 11% of the time. [Note: 60 days is in itself too long; NY law requires breach notification by private businesses  and state agencies within 30 days.]

 The Illuminate breach and problems with their privacy agreement

Some privacy vendor agreements are never even posted online in violation of the law - like that of Illuminate, which exposed the data of more than a million NYC current and former students in 2022, and yet whose privacy agreement was posted online only after the breach occurred.  Even then,  the agreement hinted that the data was not always encrypted, contrary to the requirements of the law, which turned out to be the case.  

The Illuminate example also shows that  DOE does not independently investigate breaches but instead relies on the unreliable reporting of vendors concerning the number and identity of students affected. After the data of more than 800,000 current and former NYC students was breached by Illuminate between late December 2021 and early January 2022, their families were not notified by DOE until March 25, 2022.  

Even worse, in May 2024, more than two years after the breach, a  second round of notifications to families revealed that about  380,000 more students and former students also had their information exposed.  This was also seven months after Illuminate had informed DOE of the additional students involved – far exceeding the 60 day deadline in the law, according to the information on the DOE website, which states that they started looking into this matter only after being told by Illuminate that more students were affected in October 2023.  This put additional students and former students at risk of identity theft and more, and unable to promptly acquire the insurance and credit monitoring offered by the vendor for free.

The PowerSchool breach and problems with their privacy agreement

After the massive nationwide breach of the PowerSchool student information system occurred in late December 2024,  parents throughout the country and elsewhere in the state were informed of the breach in early January 2025.  Yet at that time, DOE told a reporter they were still looking into whether any NYC schools or students were affected. 

In fact, DOE refused to confirm which schools were involved even after Daily News reported on their names  on February 6, 2025, from information relayed by the State Education Department.  Only after the Daily News reported on this did parents whose children attended these schools receive emails saying DOE was still looking into this matter.  It was not until April  2025  that DOE confirmed to parents that their children’s data had been breached, long past  the 60-day deadline in the law. 

To this day, the DOE has refused to post the names of the NYC schools affected by the PowerSchool breach on the webpage that reports on data security incidents, despite guidance from the NYSED that they should do so promptly, to alert the thousands of former students whose data was also exposed and put at risk of identity theft and worse. 

As the former NYSED Chief Privacy Officer Louise de Candia wrote on Feb.3, 2025, “ There is no doubt in my mind that PowerSchool violated Education Law Section 2-d and Part 121 of the regulations which require compliance with NIST CSF as well as reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of PII.”

And yet  DOE continues to allow NYC schools to use as many as 16 other privacy-invasive PowerSchool products, including Naviance, which is employed in many if not most New York high schools for college guidance purposes. This is despite the fact that in 2022, it was reported that Naviance  targeted ads for colleges on its student-facing platform disguised as objective recommendations and was shown to allow colleges to discriminate by race by targeting ads only to white students.

More recently, it was announced that PowerSchool had agreed to settle a class action lawsuit  alleging that the Naviance  platform contained ad tracking technology that transmitted a wide range of student data to Google, Microsoft and a company called Heap, including their names, ID numbers, graduation years,  demographic information, photographs and survey responses, as well as  their private communications with teachers.  This would violate not only state privacy laws but also the federal wiretapping statute.   Even now, the DOE has refused to tell parents or students about the Naviance agreement or  inform them they can apply for a portion of the $17.25 million settlement. 

The fact that the Illuminate and PowerSchool breaches exposed the data of many thousands of NYC students who had long graduated or otherwise left the system also shows that the data minimization and deletion by vendors required by Ed Lawa 2D is not enforced by DOE. More background here. 

To make things worse, the PowerSchool privacy agreement still posted on the DOE website is clearly non-compliant with the law, as it says that the company will only conform to the privacy requirements in federal and state law or in their contract with DOE when it is “commercially reasonable.”

Other problems highlighted in the audit and the DOE’s official response

The Comptroller’s office also found significant weaknesses in DOE’s technical data security controls that should be corrected, including “issues with system monitoring, unsupported systems, and firewalls.” Understandably, the auditors only communicated the details of these security weaknesses to DOE in a separate confidential report.  In their response, DOE makes no commitment to address these technical problems, but instead says that they would address them separately, within the confidential report.

In its response, DOE  claims to have made “several improvements to its privacy practices and policies,” including updating the Chancellor’s Regulation A-820 to “restrict the use of “directory information.”

In fact, the recent amendment to the Chancellor’s Regulation weakened the protections for student data, by redefining  a wide and essentially unlimited range of personal student information, including but not limited to their names, addresses, telephone numbers, email addresses, photographs, grade level, participation in activities and sports, and more, as directory data that can be shared with third parties, even when they are not providing services to schools.  Only an unreliable parent opt out  process was provided to prevent these disclosures from occurring.

Finally, the auditors also revealed that DOE officials took an inordinate time to respond to their requests; and that documentation requests took over five months to fulfill, while requests for meetings took two months  to schedule.  

Leonie Haimson is the co-chair of the Parent Coalition for Student Privacy, a member of the NYSED Data Privacy Advisory Committee, the Chancellor’s Data Privacy Working Group and the Chancellor’s AI Working Group

###

 

How NYC parents can opt out of data sharing and better protect their child’s privacy

 

 Important update:  Our special privacy briefing via Zoom has been rescheduled to Wed. Oct. 22 at 6 PM! 

In May 2025, the NYC Department of Education revised Chancellor’s regulations A-820, to authorize DOE and schools to disclose a category of student personal data called Directory Information for the first time within the school  or to non-school vendors, as long as parents were provided with the right to opt out.

Yet the instructions for parents on how to opt out on the DOE website are difficult to access and understand, requiring clicks across many webpages and forms.  In some cases, the webpages omit key details, including which grade levels these disclosures apply to and the deadlines for opting out.  In at least case, the deadline listed is from last year and in the case of disclosures to charter schools requires that you know your child’s OSIS number.

1. How to opt out of the disclosure of your child’s Directory Information

To simplify the opt out process for parents, the Parent Coalition for Student Privacy has developed a simple one page opt out form that offers all this information in a clear and organized fashion, and can be printed, filled out and handed in at your child’s school.

To be clear, this is an unofficial form that we have created based on the opt out form used by Los Angeles public schools.  Though we repeatedly urged DOE to create a similar form, they have refused to do so.  Still, we recommend you print this form , fill it out and hand it in at your school as soon as possible.

• In any case, to ensure that the DOE recognizes your intention to opt out, you should also check our instructions on how to opt out of four different directory information disclosures that DOE intends to make: to charter schools, the military and/or colleges for recruitment purposes, as well as the National Student Clearinghouse.

• Also, here are  instructions on how opt out of the NYC Kids Rise savings program, which DOE and the company have made especially complicated.

• Your school is also supposed to provide you with a separate opt-out form for whatever disclosures they intend to make to other organizations and/or purposes, as well as specific information about what data will be disclosed in each case if you do not opt out. If you haven’t received that form, ask your principal or Parent Coordinate for it asap.

• If any of these disclosures are being made to companies or individuals outside of the school community, there must also be a written agreement or contract that protects the confidentiality of your child’s personal data. This is the only significant change that we managed to convince DOE to make to improve their initial proposed regulations.  Ask your principal to provide that written agreement.

Additional questions parents should be asking about their children’s privacy and ed tech at their schools

In any case, it is important to note that  the instructions above only deal with the category of directory information provided to non-school vendors, generally for non-educational purposes.

DOE and individual schools have signed up with more than 500 ed tech companies to provide various types of services and programs, each of which collect and process personal student  data, much of it extremely sensitive.  As a result, NYC students have suffered multiple damaging data breaches over the last few years.

While in most cases, parents cannot opt out of this type of disclosure, they do have the right under NY Ed Law 2D  to be alerted as to which companies have access to their children’s personal info, how it will be protected from breaches and misuse, and how they can check to see if it is accurate and ask for it to be corrected if necessary.  See our Parent Bill of Rights summary here.

So if you are concerned about your child’s privacy, here are some additional questions that you should ask your principal or School Leadership Team about the educational apps or programs employed in your child’s classroom and school:

• Request the names of all the ed tech programs used by your children, their teachers, and/or school administrators that can access your child’s personal information. Be sure to request the names of all the programs that DOE has told them to use, as well as the programs that the administrators or teachers have chosen  that collect or process your child’s personal student data.
• If they seem reluctant, remind them that the state student privacy law, Ed Law 2D, provides parents with the right to see the data collected by outside agencies, companies, organizations or other third parties. Parents cannot do that unless they know the names of these programs or apps.
• Also, ask for a copy of the privacy and security protections for each of these programs, explaining how the data is secured, minimized and deleted when it is no longer necessary to provide the contracted services.

Some of that information is supposed to be on the DOE website but we have too often found that critical information there is missing or incomplete.   As a result, data breaches are all too common, including of the information of students  who have long graduated.

• Be sure to ask specifically which of these programs use Artificial Intelligence, and which additional privacy protections are for these programs, if any. Many AI programs are known to mine personal student data to improve their products, which is illegal under Ed Law 2D and/or its regulations.
• You should also ask how many hours per day or per week your child is spending on computers while in school. Now that there is a school cell phone ban, parents should also be concerned about excessive screen time in schools, which has been shown to be far less effective in terms of  student learning and engagement than classroom debate and discussion, as well as reading, writing and doing math on paper.

Finally, I will be holding a special privacy briefing for parents on Wed. October 22 at 6 PM to go over these and more issues in more depth. 

This  is the same day as the deadline of October 22 to be able to opt out of the disclosure of personal info of 11^th and 12^th graders for the purposes of military and/or college recruitment. 

 You can register for this briefing here or at https://tinyurl.com/specialprivacybriefing 

Or scan the QR code below. 

Success Academy charters: their documented history of flouting the law including requiring teachers to engage in political activity

 

Update:  Watch out Florida!  Success Academy plus billionaire Ken Griffin, a GOP megadonor have pushed through legislation in that state to allow charter school expansion and co-locations inside public school buildings.  This divisive policy has caused great controversy and a loss of space needed for class size reduction and other necessary services in NYC public schools since Bloomberg/Klein began co-locating charters in 2005.  It was also illegal as there was no charge for this space, while the law said charters should be charged the market value for free space.  We helped launch a lawsuit against this practice in 2011, which very slowly moved through the courts until at then-Gov. Cuomo's behest, the law was changed in 2014 so that from then on, NYC would be obligated to provide free space to all new and expanding charters in public school buildings or help subsidize their rent in private buildings.  NYC is the only district in the state and the nation with this obligation.

Last Thursday, September 18, 2025, several large charter school networks held a rally in Cadmen Plaza and a march across the Brooklyn Bridge to push for the continued expansion of the charter school sector.  This was apparently provoked by the fact that the leading candidate for Mayor, Zohran Mamdani, has said he opposes allowing more charter schools to open, especially since they have reached their legal cap in NYC under state law.

Liz Kim, reporter at Gothamist, got hold of a tape of a speech that Eva Moskowitz, CEO of the largest charter school chain, Success Academy, gave to her Charter Management Staff and 158  new teachers, exhorting them to attend this march and rally, and to make at least five “phone-to-action” calls to their elected officials.

In the speech, Moskowitz harshly reprimanded those who had not yet done so: “You did not do the phone-to-action because you thought, ‘This is not very serious,’” she said. “So I want to just reset for all of you. It is an existential threat.”  And:

“We have faced threats throughout the last 20 years, we have a core competency in political threats, unfortunately. But this is one of these moments where there is heightened risk, policy risk, political risk, and so we are going to do what we've always done, which is to stand up for children and families in a massive way in Cadman Plaza to speak our minds and to make sure that government works for children and families. … government doesn't naturally work for the people. It has to be forced and made to work for the people. So we're doing two things. One is this parent mobilization, and the second is our phone to action campaign. 

And our goal is to send elected officials, two million messages. Now, teachers, you'll do a network one now and then when you get to your schools, you'll do a local one.

But I have to say that I was a little disappointed in the network, because only 25% of the network was doing the phone to action. …And you know, would be natural for you not to understand we have these nice offices, Aren't they nice? Very nice. 

You guys [work] for a not for profit, you are highly compensated. You could say, What? What? Me worry? What's there to worry about? But there's a lot to worry about, and this is not a theoretical worry. We lived through eight years of Bill de Blasio. The first thing he did when he became mayor is he threw out three of our schools.” 

This is untrue. De Blasio did not kick out three of her schools; he rejected three Success charter co-locations that had been proposed by Bloomberg before he left office but not yet implemented.  De Blasio also accepted co-locations for five other Success charter schools.

In any event, after a barrage of negative television ads,  DOE officials were browbeaten into finding and renting private space for these three Success charter schools at city expense for $5.4K - $11K per student.  By last year, the number of Success charter schools rented directly by DOE had risen to nine, with buildings added under both Mayor de Blasio and Mayor Adams, at a cost of $14.3 million annually.  By renting these buildings directly and failing to ask Success to rent the buildings themselves, they are sacrificing  60 percent reimbursement from the state  for those expenses.

At the meeting, Moskowitz was clear that she was requiring  all network staff and teachers to both make phone calls and participate in the rally:

“When we ask you to do phone to action, you kind of do it. You can't make people chase you down. … we've kind of gotten loosey goosey here and just know your managers are going to hold you accountable to an extraordinary standard of performance. … When your network are giving a directive, I think we're getting a little democratic here. We are quite hierarchical.

There is a chain of command, and when your boss asks you to do something, assuming it's not unethical or a question of conscience, you do the task. Are we clear? I do not want to have to chase people down for phone to action. Is there some argument or particular reason? Anyone live in New Jersey? Okay, that's not an excuse. I hate to tell you, list your 120 Wall Street address and get it done. ….”

She then told her staff and teachers to take out their phones and make all five phone calls to elected officials right then and there.

According to a report in Labor Notes, Success Academy employees were also required to send emails to elected officials, and were ordered to “submit screenshots of these emails to their managers to confirm they had sent them.”

Success Academy was not the only charter chain to make participation in the rally mandatory for staff, parents and students. It was also required by the Zeta charter chain, founded by Emily Kim, former attorney for Success Academy.   A document sent to staff at Zeta Charter Schools made this clear:

“100% attendance expected from all Zeta families, students, and staff. Each student must attend with a parent/guardian to ensure the safety of every child. Students cannot attend the rally without an adult family member or authorized chaperone.”

Students, their parents and staff had to arrive at Zeta at 6:30 AM to get on the bus to Cadman Plaza, according to the schedule.  If parents wanted to bring their younger children, they had “to bring their own seats for the bus ride to the rally,” presumably meaning they had to pay for their own transportation to get to Cadman Plaza.

Teachers at Zeta were told it was their responsibility to  get parents to attend:

“All teachers must ensure 100% completion through family follow-up calls Mon., Sept. 8th- Wed., Sept. 10th. Your Principal and Operations Director will share a school-wide tracker to follow up and log all family calls accordingly.”

There is a real question about whether mandatory attendance at a political event or forcing teachers to make political phone calls is legal.  The day after the rally, on Friday, John Liu, Chair of the Senate NYC Education Committee and Shelley B. Mayer, Chair of the Senate Committee on Education sent a letter to NY State Education Commissioner Betty Rosa and John King, Chancellor of State University of New York, whose agencies authorize and oversee charter schools. 

Senators Liu and Mayer expressed “great concern that many charter schools in New York City cancelled classes and pressured students, families, and staff to participate in a political “March for Excellence” on September 18, 2025. We urge the state to conduct a thorough investigation into potential violations of state law.”

They also pointed out how “canceling classes during a school day and forcing families and students to engage in a political rally is an egregious misuse of instructional time and state funds. We urge SUNY and the State Education Department to exercise their oversight authority and fully investigate this matter to determine any possible violations of state law, and if such violations are found, to claw back a portion of state per capita funding from each school administration that engaged in this event, and to take steps to ensure future misuse of student’s precious school time does not continue.”

Though they didn’t specify any laws that might have been broken, in 2023 Governor Hochul signed into law Senate Bill 4982, which prohibits employers from coercing employees into attending or participating in meetings where the primary purpose is to communicate the employer’s opinions on religious or political matters. The law also holds that the courts may impose monetary penalties on employers who do this, and that employees can seek “equitable relief and damages” in court if they do.

In any case, this is not the first time that Eva Moskowitz and Success Academy have been found guilty of breaking laws.  Repeatedly, her charter schools have been shown to deny students their legal rights, violating their privacy, and pushing out those who do not make the grade either in terms of behavior or test scores.  A sample of these documented violations are listed at the end of this post.

Evidence of inflated charter rental payments and missing matching funds

Charter schools now drain more than $3 billion dollars annually from the DOE budget, plus charge more than a  hundred million  dollarsper year in rental subsidies.  NYC is the only district in the nation that is obligated to either co-locate charters in public schools or help pay for their rent in private buildings.  This applies to all new and expanding  charter schools since 2014, after they go through a perfunctory appeal process, according to a law pushed through by then-Governor Cuomo and the charter lobby.  The amount spent on their rental expenses by DOE has risen sharply over time –though 60% of these expenditures are supposed to be reimbursed by the state.

In 2019 and 2021, Class Size Matters issued two reports that provided evidence that DOE had overspent on rental assistance to charter schools by $21 million.  We also revealed suspicious charges for rental subsidies paid by DOE to several charter schools, including those run by Success, that owned or subleased their own buildings. 

In one case, the rent for two Success Academy charter schools housed at Hudson Yards increased from approximately $793,000 to over $3.4 million in one year – more than quadrupling , causing DOE to pay  $3 million in rental subsidies for those two schools alone in 2020. 

We also found that public schools co-located with charter schools were owed millions of dollars in matching funds for facility enhancements, compared to the amounts required by state law.  From 2014 to 2019, 127 co-located public schools were owed a total of $15.5 million.

Please email Comptroller Lander and ask him to audit these programs

Shortly after the release of our second report, in March 2022, Senator John Liu, Senator Robert Jackson, and Rita Joseph, chair of the Council Education Committee, sent a letter to Comptroller Brad Lander, urging him  to audit this spending, based upon the troubling findings in our reports.  I recently learned that no such audit has been conducted.  An analysis also shows that Lander has audited fewer DOE programs than any other NYC Comptroller since 2003 at this point in office.

We are now engaged in examining DOE own reports of their spending on charter school rent, which continues to rise sharply higher each year, as well as their continuing failure to provide sufficient matching funds to public schools for facility upgrades and repairs. 

Please email the Comptroller now and urge him to launch an audit on these programs before he leaves office in January,  by filling out the form here. 

Where it says, “Your Suggestion,” please write:

“I urge you to audit DOE spending on charter rent, especially charter schools that own or sublease their own buildings, as well as charters whose buildings DOE rents directly and thus is unable to receive 60% reimbursement from the state.  Also please audit the lack of public school matching funds, as there is evidence that they continue to be owed millions for facility upgrades.” 

Feel free to rephrase this any way you like. 

Below is a brief list of legal challenges that reveal a documented pattern of Success Academy violations, including the failure of these schools to provide students with their mandated services, repeatedly suspending them for minor infractions, violating their privacy, and pushing them out when they do not conform to rigid behavioral expectations or do not score high enough on standardized exams.

Success Academy pushing out students and violating their civil rights

·       In 2016, parents, legal aid groups and  elected officials, including then NYC Public Advocate Letitia James, filed a complaint with the U.S. Department of Education's Office for Civil Rights, alleging Success Academy had made numerous violations of the rights of disabled students, including pushing them out of their schools. 

·       in 2018, Success was sued by New York Lawyers for the Public Interest (NYLPI), again alleging how they had failed to provide mandated services to students with special needs, and imposed harsh, zero-tolerance discipline. The case was settled in 2018 by Success by paying  $1.1 million in legal fees. 

·       Also in 2018, Advocates for Children of New York (AFC) filed a complaint to the NY State Education Department pointing out how Success denied special needs students their legal rights.  The following year, NYSED issued a ruling  that the charter chain had violated student civil rights under the law.  

·       In 2021, a US District Court judge ordered Success Academy to pay a $2.4 million fine to settle a claim of discrimination against five learning-disabled children, essentially forcing parents to withdraw from the school. 

·       In 2023, an Investigative report by Pro Publica revealed how Success charters make repeated calls to 911 for student misbehavior, often for minor offenses, causing the police and Child Protective Services to be involved, and suspended students repeatedly until parents agree to take them out of their schools. 

Success Academy’s dismal record on privacy:

·       In 2015, Success Academy officials published exaggerated details of a student’s records when he was attending Upper West Success, and shared them with reporters nationwide, to retaliate against him and his parent after they were interviewed on the PBS News Hour about his repeated suspensions and the abusive treatment he suffered at the hands of Success school staff from first grade onwards.  The school was subsequently found guilty of violating both the state student privacy law by the NY State Chief Privacy Officer (CPO), as well as the federal privacy law known as FERPA by the US Education Department, when they finally ruled years later. 

·       In 2016, SUNY Charter Institute noted unspecified violations of FERPA by Success Academy Cobble Hill,  Success Academy Crown Heights,  Success Academy Fort Greene,  Success Academy Harlem 2, and  Success Academy Harlem 5 during site visits, as noted in their Renewal reports. 

·       In 2019, Success Academy Prospect Heights retaliated against a parent by releasing her daughter’s education records to a reporter, including notes from psychologists and her special education plan, after the parent had spoken out about how her child had been effectively pushed out of the school by repeatedly calling home about behavioral issues, threatening to call child services, and sending her back to kindergarten after she started first grade. 

·       In October 2023, a parent filed a complaint that Success Academy Rockaway Park Middle School had improperly posted the grades of her child on the walls of their school.  On December 21, 2023, the State Chief Privacy Officer (CPO) ruled that the school had violated both federal and state student privacy law. 

·       In February 2024, Success appealed this decision, claiming that the parent had signed a consent form allowing this disclosure, but in March 2023 the State CPO pointed out that the consent form did not specify the student records to be disclosed or the purpose for such disclosures, and did not clearly state to whom these disclosures could be made.  The CPO also attached a model FERPA consent form that the school should use. 

·       Yet on March 7, 2024, a different parent whose child attended Success Academy Cobble Hill Elementary School filed a similar complaint, and that her school had posted her child’s name and test scores on a bulletin board in a public hallway at the school.  After she had first raised this issue with the principal, and her concerns were dismissed, she removed the posting from the bulletin board.  The school then banned the parent from entering the building, even to pick up her child at the end of the school day. Again, the school claimed this disclosure was allowed by the generic consent form that the parents had filled out. Yet  as the CPO pointed out in April 2024, the consent form was not specific enough about what personal information would be disclosed, and where, and thus the school had violated both FERPA and NY State privacy law.