New York State Education Department Privacy Office Enforces Penalties Against File Scanning Service for Data Breach

Commissioner Betty A. Rosa today announced that the State Education Department's Privacy Office has collected $125,000 from Instream, a file scanning service, as a civil penalty for a data breach that occurred in July 2024. The Department determined that the breach compromised Personally Identifiable Information (PII) and that Instream violated the law by failing to provide notification within the required timeframe.

Board of Regents Chancellor Lester W. Young, Jr. said, "Schools must be able to trust that the vendors they work with take data privacy seriously, and that trust must be earned every day through rigorous safeguards and unwavering compliance with our privacy laws. When service providers fail to uphold that responsibility and violate the law, they must be held accountable to ensure such incidents do not happen again. I commend the Department's Privacy Office for its diligent work in reaching this settlement and for strengthening protections for schools across New York State."

Commissioner Rosa said, "Vendors that contract with educational agencies have a fundamental responsibility to protect the sensitive information entrusted to them. The failure to both safeguard that information and report the breach within the appropriate timeframe not only undermined Instream's legal obligations, but the public's trust as well. This settlement sends a clear message that New York State will hold service providers accountable when they fail to protect sensitive data or comply with our privacy laws."

In addition to the civil penalty of $125,000, Instream will also be required to provide NYSED with a risk assessment report informed by third-party testing; to implement multi-factor authentication on any system where PII is accessible; to verify VPNs or other sources attempting to connect to the organization; and to create an incident response plan that includes notification of affected data to educational agencies in accordance with the law.

More information about data privacy, including instructions for students and parents to file a privacy complaint, is available on the Department's Privacy Office website.