{"id":220883,"date":"2026-05-05T17:33:08","date_gmt":"2026-05-05T17:33:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/us-ny\/220883\/"},"modified":"2026-05-05T17:33:08","modified_gmt":"2026-05-05T17:33:08","slug":"state-audit-slams-nyc-schools-for-lack-of-student-data-privacy-oversight-2","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us-ny\/220883\/","title":{"rendered":"State audit slams NYC schools for lack of student data privacy oversight"},"content":{"rendered":"

This story was originally published<\/a> by Chalkbeat. Sign up for their newsletters at ckbe.at\/newsletters<\/a>.<\/p>\n

From student addresses to bus routes, New York City public schools collect and manage large amounts of sensitive personal information on its nearly 900,000 students.<\/p>\n

But a new audit<\/a> released Monday found that the nation\u2019s largest school system \u201cdoes not have a clear understanding\u201d of the data it collects or the risks it faces. There are major gaps in state-required data security policies and weaknesses in how student information is tracked, secured, and managed, the audit of the city\u2019s student data and privacy operations by state Comptroller Thomas DiNapoli showed.<\/p>\n

The report \u2014 which spans from 2020 to 2025, and covers five different chancellors \u2014 also cites multiple security breaches of data stored in third-party products used by schools. Upon examining those breaches, auditors found that the Education Department does not maintain a complete inventory of software used across schools.<\/p>\n

The findings come at a critical moment for city schools: The Education Department\u2019s recently released framework for AI<\/a> could potentially open the floodgates to schools using more tech in day-to-day operations from lesson planning to translating materials for bilingual learners.<\/p>\n

While auditors did not find a direct violation of the federal Family Educational Rights and Privacy Act, which would require reporting a breach to the federal government, the state said the gaps in data policy and process could put the district at risk of noncompliance.<\/p>\n

\u201cProtecting the privacy and security of student data is of the utmost importance to NYCPS,\u201d Kevin Moran, deputy chancellor of school operations wrote to DiNapoli in response to the audit. \u201cIn the past year alone, NYCPS has made several improvements to its privacy practices and policies.\u201d<\/p>\n

The city, for instance, has made a new student privacy webpage<\/a> to inform families of their privacy rights, and it convened a data privacy working group of school leaders, parents, advocates, and industry experts. And while the city accepted most of the comptroller\u2019s recommendations, saying on Monday that it \u201cwill continue strengthening policies, oversight, and training to ensure student information is protected across our schools,\u201d it also took issue with some of the state\u2019s findings.<\/p>\n

Data breaches show lack of central oversight, auditors say<\/p>\n

New York City\u2019s schools system has fallen victim to a few high-profile cyberattacks in recent years, including a security breach that occurred in Illuminate, a platform used for online grading that affected the personal information of about 820,000 current and former students in the 2021-22 school year<\/a>. In a 2024 data breach of PowerSchool, a school records program, hackers accessed students\u2019 names and dates of birth. The city\u2019s Education Department did not know about the breach until January 2025, according to the audit.<\/p>\n

Affecting over 3,000 students and 317 staffers, the PowerSchool incident revealed that the Education Department has no centralized tracking system for what programs each school uses, auditors said. City officials had to reach out to schools individually to find out which had been affected. Education officials ultimately confirmed that four schools had been part of the breach.<\/p>\n

In all, the audit identified 141 data security incidents involving breaches of student and staff information from both third-party vendors or internal Education Department systems between January 2023 to February 2025.<\/p>\n

\u201cNew York City Public Schools does not have a clear understanding of what third party actually has access to the students\u2019 information,\u201d said Tina Kim, head of the comptroller\u2019s state government accountability division. \u201cIf there is a breach at one of these different vendors, they don\u2019t know who to notify, or what school to go to.\u201d<\/p>\n

The audit also surveyed whether individual New York City public schools use other electronic reporting systems than the two known central ones (Automate The Schools and STARS). Of the 528 schools that responded, 218 said they used at least 70 different applications, \u201creflecting decentralized and uncoordinated application usage,\u201d according to the report.<\/p>\n

Community members calling for a moratorium on AI voiced concerns about schools\u2019 increasing use of third-party tech programs during last week\u2019s contentious Panel for Educational Policy meeting<\/a>. Many said they\u2019re concerned that the Education Department doesn\u2019t have sufficient oversight of school educational technology products.<\/p>\n

The comptroller\u2019s report \u201cconfirms what many NYC advocates have long known,\u201d Leonie Haimson, the executive director for Class Size Matters and a long-time advocate for stricter school privacy controls, said in a statement<\/a>. \u201cThe privacy policies and practices of the NYC Dept. of Education are sloppy, irresponsible and show a lack of concern for keeping students\u2019 personal information safe from breach and misuse.\u201d<\/p>\n

She criticized the city\u2019s new AI framework, \u201cgiven how these tools represent an even greater risk to student privacy and safety.\u201d<\/p>\n

In response to the audit\u2019s findings, the Education Department agreed to update its data classification policy and create a process for tracking school-level technology program usage.<\/p>\n

But school officials took issue with the audit\u2019s claim that the city \u201clacks centralized oversight,\u201d saying that schools use a centralized process to vet third-party vendors <\/a>to ensure only approved products are used.<\/p>\n

Auditors, however, said approval through the city\u2019s vendor vetting process isn\u2019t the issue. Even with the current vetting process, the Education Department doesn\u2019t know which individual schools are using which systems and whether those systems contain sensitive student data.<\/p>\n

Incomplete staff training and reporting delays highlight compliance failures<\/p>\n

The audit also found roughly 25% of the Education Department \u2014 nearly 43,000 employees \u2014 did not complete annual data privacy training. State rules require the training to ensure the protection of student data. Auditors said the district does not have a system to confirm whether untrained employees can still access sensitive data.<\/p>\n

Education Department officials said they would explore ways to increase completion rates but argued that tracking only staff with access to sensitive data is administratively complex.<\/p>\n

Nearly half of data incidents were reported to the state Education Department later than the 10 days allotted, and families were notified later than the 60 days deadline in about 11% of cases. The city said these delays came from time-consuming third-party investigations but vowed to improve timeliness. The state comptroller called the delays \u201cunacceptable\u201d and said the Education Department rejected suggested changes to its internal audit process.<\/p>\n

Panel for Educational Policy member Naveed Hasan said the findings in the comptroller\u2019s report were \u201cnot at all surprising\u201d and that the city lacks staffing and resources to address data privacy issues.<\/p>\n

\u201cMy ongoing policy recommendation is to reconsider the outsourcing of what should be in-house technology implementation by NYC,\u201d said Hasan, who supports a two-year moratorium on AI use. \u201cWe should be building and maintaining infrastructure to better address data security and privacy before they become breaches.\u201d<\/p>\n

The state comptroller\u2019s office said they will conduct a follow-up audit of the city\u2019s progress after one year.<\/p>\n

Lizzie Walsh is a Data Fellow at Chalkbeat New York. She reports on New York City education and produces data-driven stories across Chalkbeat\u2019s national network. Contact her at ewalsh@chalkbeat.org.<\/p>\n

Chalkbeat is a nonprofit news site covering educational change in public schools.<\/p>\n","protected":false},"excerpt":{"rendered":"This story was originally published by Chalkbeat. Sign up for their newsletters at ckbe.at\/newsletters. From student addresses to…\n","protected":false},"author":2,"featured_media":220884,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[3007,3771,9,56,63,65,64,306,209,87053,86550],"class_list":["post-220883","post","type-post","status-publish","format-standard","has-post-thumbnail","category-new-york-city","tag-cybersecurity","tag-data-breach","tag-new-york","tag-ny","tag-nyc","tag-nyc-headlines","tag-nyc-news","tag-privacy","tag-public-schools","tag-state-auditor","tag-student-data"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/posts\/220883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/comments?post=220883"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/posts\/220883\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/media\/220884"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/media?parent=220883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/categories?post=220883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us-ny\/wp-json\/wp\/v2\/tags?post=220883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}