Council Demands Unredacted Vendor DPAs as DOE Says Student‑Data Contracts Are Largely Confidential; Breaches Cited

The New York City Council Committee on Education and Technology held a hearing on June 24, 2026 at City Hall to examine the Department of Education’s (DOE) use of artificial intelligence (AI) and educational technology (edtech), how student data are handled by large vendors, why portions of data processing agreements (DPAs) are redacted or withheld, and whether unredacted DPAs will be provided to Council staff. Source: https://youtu.be/VfIjWNkh0wk&t=10589

# What’s happening
– The Council held a hearing on DOE AI, edtech, and student privacy on June 24, 2026. Source: https://youtu.be/VfIjWNkh0wk&t=0
– DOE chief privacy officer said DOE has data processing agreements with all third‑party vendors. Source: https://youtu.be/VfIjWNkh0wk&t=1348
– DOE staff said DPAs are not routinely posted publicly; records access unit handles disclosure. Source: https://youtu.be/VfIjWNkh0wk&t=6836

# Why it matters
– Students and families lack clear public records of which vendors process student data. Source: https://youtu.be/VfIjWNkh0wk&t=10589
– Unclear DPA transparency affects parents’ ability to verify vendor approvals and breach notifications. Source: https://youtu.be/VfIjWNkh0wk&t=12596

# Key details
– Hearing date and location: June 24, 2026, Council Chambers at City Hall. Source: https://youtu.be/VfIjWNkh0wk&t=0
– DOE testimony: the department said it maintains data processing agreements (DPAs) with all vendors that process student data. Source: https://youtu.be/VfIjWNkh0wk&t=1348
– DOE review process: the Enterprise Request Management Application (Irma) is DOE’s privacy and security review process for third‑party tools. Source: https://youtu.be/VfIjWNkh0wk&t=7577
– Vendor actions: Illuminate Education was removed as a DOE vendor after a widescale breach reported in testimony. Source: https://youtu.be/VfIjWNkh0wk&t=8540
– Security and legal issues: PowerSchool products were discussed in testimony for past security failures and a $17.25 million settlement. Source: https://youtu.be/VfIjWNkh0wk&t=12596
– Public input on AI guidance: DOE reported receiving 6,491 public comments on its AI guidance and said it intends to share those comments. Source: https://youtu.be/VfIjWNkh0wk&t=1035

New York City Department of Education (DOE)
– Role or jurisdiction: City agency running New York City public schools. Source: https://youtu.be/VfIjWNkh0wk&t=0
– Action taken or responsibility: Testified about edtech reviews, DPAs, and privacy processes at the June 24, 2026 hearing. Source: https://youtu.be/VfIjWNkh0wk&t=1348
– Relevant numbers or dates: 6,491 public comments received on AI guidance; hearing June 24, 2026. Source: https://youtu.be/VfIjWNkh0wk&t=1035

Dennis Doyle
– Role or jurisdiction: DOE chief privacy officer. Source: https://youtu.be/VfIjWNkh0wk&t=1348
– Action taken or responsibility: Described DOE use of data processing agreements and Irma review process to Council. Source: https://youtu.be/VfIjWNkh0wk&t=7577
– Relevant numbers or dates: Provided testimony during the June 24, 2026 Committee on Education and Technology hearing. Source: https://youtu.be/VfIjWNkh0wk&t=1348

The Committee opened by asking which vendor contracts and data processing agreements (DPAs) exist between the DOE and major edtech vendors and why portions of those agreements are redacted. Source: https://youtu.be/VfIjWNkh0wk&t=10589

DOE’s chief privacy officer, Dennis Doyle, told the Committee the DOE has data processing agreements with all third‑party vendors that process student data, and that those agreements include confidentiality obligations. Source: https://youtu.be/VfIjWNkh0wk&t=1348

Council members pressed whether those DPAs are publicly posted. DOE staff said the department does not routinely post internal DOE records or contracts publicly and deferred specific disclosure questions to the records access unit. Source: https://youtu.be/VfIjWNkh0wk&t=6836

Witnesses raised concerns that DOE‑designated vendors are effectively “school officials” with access to student data, and named HMH (which hosts Amira), Paragon, Accenture, and Salesforce among companies discussed as part of vendor relationships. Those witnesses argued parents and communities deserve clearer access to DPAs and vendor approval evidence. Source: https://youtu.be/VfIjWNkh0wk&t=10589

Committee members and witnesses described the DOE’s Irma process — the Enterprise Request Management Application — as the department’s privacy and security review process, including a cloud review conducted with the Office of Technology and Innovation (OTI). Source: https://youtu.be/VfIjWNkh0wk&t=7577

Testimony cited prior vendor security problems. Committee witnesses said Illuminate Education experienced a widescale breach and New York City public schools stopped doing business with that vendor. Source: https://youtu.be/VfIjWNkh0wk&t=8540

The hearing included discussion of PowerSchool products and past security incidents; testimony referenced a national settlement of $17.25 million related to illegal data disclosures, and noted families may be eligible without citywide notification. Source: https://youtu.be/VfIjWNkh0wk&t=12596

DOE staff said some security incidents trigger the same obligations under New York’s Education Law 2‑D and that cyber incidents are reviewed with OTI and DOE cybersecurity teams. Source: https://youtu.be/VfIjWNkh0wk&t=9046

Committee members asked whether the Council would receive unredacted DPAs. One Council member said she expected the Council to have those DPAs and noted testimony indicating vendors did not require the DOE to withhold contract existence. DOE staff responded that disclosure questions rest with the records access office. Source: https://youtu.be/VfIjWNkh0wk&t=6836

Witnesses and advocacy groups urged stronger privacy controls and described calls for a two‑year moratorium on AI in schools; the testimony urged clearer vendor transparency and better implementation of prior audit recommendations. Source: https://youtu.be/VfIjWNkh0wk&t=12767

DOE told the Committee it received 6,491 pieces of public feedback on its AI guidance and said it intends to make that feedback available. Source: https://youtu.be/VfIjWNkh0wk&t=1035

Testimony referred to required annual privacy and security training for DOE employees and noted an audit finding that in 2024 only 73% of employees completed the required training. Source: https://youtu.be/VfIjWNkh0wk&t=5633

Several witnesses raised concerns about private equity ownership and vendor consolidation in edtech, and about whether vendor approvals under the Irma process are trackable or visible to the public. Source: https://youtu.be/VfIjWNkh0wk&t=10589

Council staff and DOE agreed to follow up on specific requests, including sharing available Irma review materials, the public comments on AI guidance, and clarifying how DPAs are disclosed to Council staff and the public. Source: https://youtu.be/VfIjWNkh0wk&t=1348

For follow‑up or to review testimony, the Committee hearing video is publicly available. Source: https://youtu.be/VfIjWNkh0wk&t=0