State audit slams NYC schools for lack of student data privacy oversight

This story was originally published by Chalkbeat. Sign up for their newsletters at ckbe.at/newsletters.

From student addresses to bus routes, New York City public schools collect and manage large amounts of sensitive personal information on its nearly 900,000 students.

But a new audit released Monday found that the nation’s largest school system “does not have a clear understanding” of the data it collects or the risks it faces. There are major gaps in state-required data security policies and weaknesses in how student information is tracked, secured, and managed, the audit of the city’s student data and privacy operations by state Comptroller Thomas DiNapoli showed.

The report — which spans from 2020 to 2025, and covers five different chancellors — also cites multiple security breaches of data stored in third-party products used by schools. Upon examining those breaches, auditors found that the Education Department does not maintain a complete inventory of software used across schools.

The findings come at a critical moment for city schools: The Education Department’s recently released framework for AI could potentially open the floodgates to schools using more tech in day-to-day operations from lesson planning to translating materials for bilingual learners.

While auditors did not find a direct violation of the federal Family Educational Rights and Privacy Act, which would require reporting a breach to the federal government, the state said the gaps in data policy and process could put the district at risk of noncompliance.

“Protecting the privacy and security of student data is of the utmost importance to NYCPS,” Kevin Moran, deputy chancellor of school operations wrote to DiNapoli in response to the audit. “In the past year alone, NYCPS has made several improvements to its privacy practices and policies.”

The city, for instance, has made a new student privacy webpage to inform families of their privacy rights, and it convened a data privacy working group of school leaders, parents, advocates, and industry experts. And while the city accepted most of the comptroller’s recommendations, saying on Monday that it “will continue strengthening policies, oversight, and training to ensure student information is protected across our schools,” it also took issue with some of the state’s findings.

Data breaches show lack of central oversight, auditors say

New York City’s schools system has fallen victim to a few high-profile cyberattacks in recent years, including a security breach that occurred in Illuminate, a platform used for online grading that affected the personal information of about 820,000 current and former students in the 2021-22 school year. In a 2024 data breach of PowerSchool, a school records program, hackers accessed students’ names and dates of birth. The city’s Education Department did not know about the breach until January 2025, according to the audit.

Affecting over 3,000 students and 317 staffers, the PowerSchool incident revealed that the Education Department has no centralized tracking system for what programs each school uses, auditors said. City officials had to reach out to schools individually to find out which had been affected. Education officials ultimately confirmed that four schools had been part of the breach.

In all, the audit identified 141 data security incidents involving breaches of student and staff information from both third-party vendors or internal Education Department systems between January 2023 to February 2025.

“New York City Public Schools does not have a clear understanding of what third party actually has access to the students’ information,” said Tina Kim, head of the comptroller’s state government accountability division. “If there is a breach at one of these different vendors, they don’t know who to notify, or what school to go to.”

The audit also surveyed whether individual New York City public schools use other electronic reporting systems than the two known central ones (Automate The Schools and STARS). Of the 528 schools that responded, 218 said they used at least 70 different applications, “reflecting decentralized and uncoordinated application usage,” according to the report.

Community members calling for a moratorium on AI voiced concerns about schools’ increasing use of third-party tech programs during last week’s contentious Panel for Educational Policy meeting. Many said they’re concerned that the Education Department doesn’t have sufficient oversight of school educational technology products.

The comptroller’s report “confirms what many NYC advocates have long known,” Leonie Haimson, the executive director for Class Size Matters and a long-time advocate for stricter school privacy controls, said in a statement. “The privacy policies and practices of the NYC Dept. of Education are sloppy, irresponsible and show a lack of concern for keeping students’ personal information safe from breach and misuse.”

She criticized the city’s new AI framework, “given how these tools represent an even greater risk to student privacy and safety.”

In response to the audit’s findings, the Education Department agreed to update its data classification policy and create a process for tracking school-level technology program usage.

But school officials took issue with the audit’s claim that the city “lacks centralized oversight,” saying that schools use a centralized process to vet third-party vendors to ensure only approved products are used.

Auditors, however, said approval through the city’s vendor vetting process isn’t the issue. Even with the current vetting process, the Education Department doesn’t know which individual schools are using which systems and whether those systems contain sensitive student data.

Incomplete staff training and reporting delays highlight compliance failures

The audit also found roughly 25% of the Education Department — nearly 43,000 employees — did not complete annual data privacy training. State rules require the training to ensure the protection of student data. Auditors said the district does not have a system to confirm whether untrained employees can still access sensitive data.

Education Department officials said they would explore ways to increase completion rates but argued that tracking only staff with access to sensitive data is administratively complex.

Nearly half of data incidents were reported to the state Education Department later than the 10 days allotted, and families were notified later than the 60 days deadline in about 11% of cases. The city said these delays came from time-consuming third-party investigations but vowed to improve timeliness. The state comptroller called the delays “unacceptable” and said the Education Department rejected suggested changes to its internal audit process.

Panel for Educational Policy member Naveed Hasan said the findings in the comptroller’s report were “not at all surprising” and that the city lacks staffing and resources to address data privacy issues.

“My ongoing policy recommendation is to reconsider the outsourcing of what should be in-house technology implementation by NYC,” said Hasan, who supports a two-year moratorium on AI use. “We should be building and maintaining infrastructure to better address data security and privacy before they become breaches.”

The state comptroller’s office said they will conduct a follow-up audit of the city’s progress after one year.

Lizzie Walsh is a Data Fellow at Chalkbeat New York. She reports on New York City education and produces data-driven stories across Chalkbeat’s national network. Contact her at ewalsh@chalkbeat.org.

Chalkbeat is a nonprofit news site covering educational change in public schools.