New York State Education Department Privacy Office Collects Penalties From Technology Companies for Violating Student and Parent Privacy Protections

Commissioner Betty A. Rosa today announced that the State Education Department’s Privacy Office has collected nearly $300,000 in penalties from technology companies whose practices violated student and parent data privacy protections. The penalties were enforced against two companies, rSchoolToday and Raptor Technologies, which paid $120,000 and $167,000, respectively.

Board of Regents Chancellor Lester W. Young, Jr. said, “Protecting the private information of our students and families is of utmost importance. It is deeply concerning that these companies failed to uphold the rigorous standards required by the Board of Regents and the Education Department. The corrective measures we’ve imposed hold the responsible parties accountable and demonstrate that we have zero tolerance for those who violate our privacy laws.”

Commissioner Rosa said, “School districts must be able to trust that the technology platforms and software they utilize have safeguards in place to protect the privacy of student and parent data. Unfortunately, these two companies fell short, compromising the personally identifiable information of minors and their guardians. I commend the Department’s Privacy Office for investigating these cases and holding those responsible accountable.”

rSchoolToday is a high school sport and activity management software company that assists school districts in scheduling, fundraising, and managing athletics-adjacent tasks. The company was found to have published personally identifiable information (PII) of students and parents in YouTube videos intended to serve as product demonstrations. The data of 19 individuals—11 from East Aurora UFSD and 8 from Monroe-Woodbury CSD—remained on the YouTube channel for nine months in videos that were viewed a combined total of 66 times. In addition to the $120,000 penalty, rSchoolToday has agreed to institute a training program for employees.

Raptor Technologies is a software company that provides school safety solutions, including visitor management and emergency management systems. A security researcher at Raptor Technologies discovered a vulnerability in these systems that made files in the cloud-hosted storage unsecure and publicly accessible. This incident impacted schools nationwide, though there is no evidence that any files were accessed by the public. Moving forward, Raptor Technologies will provide annual notification to New York State schools of the data they are storing with the company and institute data minimization practices when collecting data from New York schools in addition to the $167,000 penalty.

More information about data privacy, including instructions for students and parents to file a privacy complaint, is available on the Department’s Privacy Office website.