秘密研究所

Commissioner Betty A. Rosa today announced that the State 秘密研究所 Department鈥檚 Privacy Office has collected $125,000 from Instream, a file scanning service, as a civil penalty for a data breach that occurred in July 2024. The Department determined that the breach compromised Personally Identifiable Information (PII) and that Instream violated the law by failing to provide notification within the required timeframe.

Board of Regents Chancellor Lester W. Young, Jr. said, 鈥淪chools must be able to trust that the vendors they work with take data privacy seriously, and that trust must be earned every day through rigorous safeguards and unwavering compliance with our privacy laws. When service providers fail to uphold that responsibility and violate the law, they must be held accountable to ensure such incidents do not happen again. I commend the Department鈥檚 Privacy Office for its diligent work in reaching this settlement and for strengthening protections for schools across New York State.鈥�

Commissioner Rosa said, "Vendors that contract with educational agencies have a fundamental responsibility to protect the sensitive information entrusted to them. The failure to both safeguard that information and report the breach within the appropriate timeframe not only undermined Instream鈥檚 legal obligations, but the public鈥檚 trust as well. This settlement sends a clear message that New York State will hold service providers accountable when they fail to protect sensitive data or comply with our privacy laws."

In addition to the civil penalty of $125,000, Instream will also be required to provide NYSED with a risk assessment report informed by third-party testing; to implement multi-factor authentication on any system where PII is accessible; to verify VPNs or other sources attempting to connect to the organization; and to create an incident response plan that includes notification of affected data to educational agencies in accordance with the law.

More information about data privacy, including instructions for students and parents to file a privacy complaint, is available on the Department鈥檚 Privacy Office website.