State Audit Finds Major Data Privacy Issues at NYC Schools

Source Domain: www.govtech.com

(TNS) — NYC public schools suffer from glaring omissions in student data privacy policies, a new audit by State Comptroller Tom DiNapoli found, raising fresh concerns about the embrace of artificial intelligence in the classroom.

For example, auditors found the city’s school system doesn’t have written policies on risk assessment and data backups, or keep a full list of all applications used by local schools. More than a quarter of school employees skip annual cybersecurity trainings, according to the comptroller’s office — and if a breach does occur, local education officials may fail to report the incident or notify families in a timely manner.

“Protecting student data is paramount,” DiNapoli said in a statement. “My auditors found NYCPS needs to take additional actions to better secure the privacy and security of student data, including reporting breaches or notifying affected parties within the required time frames.”

In 141 breaches and inadvertent data releases between 2023 and 2025, the comptroller’s office found officials delayed reporting 48 percent of incidents to the New York State Education Department, and held up notifying families about 11 percent of the time. Delayed notifications ranged from 1 to 460 days.

DiNapoli issued the audit amid growing resistance to AI — and education technology in general — in public schools across the five boroughs.

Schools Chancellor Kamar Samuels in March provided teachers and principals with initial guidance on AI in the classroom, with a full playbook due next month. The guidance sparked protests and got more parents and teachers involved in a local movement against AI.

The response led Samuels to pump the breaks on a controversial plan to open the city’s first AI-focused high school. While officials have declined to release the data, the proposal’s backers estimate that close to 1,000 students applied. Concerned students,…

Source