A Practicing DPO's Guide to NY Ed Law 2-d

JAY RUDKIN

Alright. Well, out of respect for those of you who have joined, we'll go ahead and get started. I see the seats are beginning to fill. Class is in session. Sorry, teacher jokes. My wife's a teacher, so she's going to bust me later for these. But I'm excited to see you all here today.

Some of you know me. I'm Jay Rudkin from Virtru, in my fifth year at Virtru, supporting K-12. I'm joined today by Michelle Krieger. She's the data protection officer at Lakeshore Central Schools and the coauthor of From Chalk Dust to Digital Trust, a guide to data privacy and security for K-12 leaders.

We're providing this fireside-style chat as a value-add for our existing customers, as well as for school district technology leaders and data protection officers generally, to help demystify common challenges and concerns you face and to share best practices for handling sensitive student and staff information.

We're excited to have one of the best with us here today. Many of you may know Michelle. You may have seen Michelle and me supporting an event at the DPSS [?] in March, in New York.

Let me ask Michelle to introduce herself and talk about her experience and her current role a little before we go much further, if you don't mind.

MICHELLE KRIEGER

Absolutely. Thanks for having me today, and welcome, everyone.

As Jay mentioned, I am a data protection officer. Full sentence. I am not a director of technology. I'm not a technology coordinator. I am a data protection officer. Bit of a unicorn. I know that isn't probably what most of you on the call are feeling right now, that you have that single role, so I'll take that into consideration as we go through our chat today.

I have been in education for over twenty-five years. I originally started as a teacher of special education, so I'm coming at this role as a DPO from the classroom. My background is not in technology. My background is in education. We'll get into the role of a data protection officer, and I'll clarify why I see not having the technical background as a bit of an advantage, where others might not have thought that.

So, Jay, that's who I am. As you mentioned, I'm the coauthor of From Chalk Dust to Digital Trust, which I'll probably mention a bit more throughout our talk. I also encourage anybody on this call to join me on LinkedIn. I have a newsletter, and I actually posted one today [newsletter name unclear in recording]. So, let's get started.

JAY RUDKIN

That's awesome. Thank you, Michelle. So today, folks, we're going to talk about what Ed Law 2-d actually requires when it comes to encryption, since Virtru is an encryption solutions provider as part of what we do, and what it looks like to operationalize that in a real district. Even the most prepared DPOs will still have gaps. Michelle is the expert in the room today, so you'll largely see me asking her questions. Please drop your questions in the chat as we go, and we'll get to them at the end of the call.

We also recognize that some of you here today are not from New York State at all. You're not bound by the New York requirements we're going to discuss, but you're striving to follow best practices, and I find many follow these requirements anyway. So we think there's going to be a lot of value in here for you as well. Thanks for attending.

Now, for those of you who... please, Michelle.

MICHELLE KRIEGER

Go ahead, Jay. I was just going to say that all of us on the call are most likely bound by this cybersecurity framework, so a lot of what we're going to talk about today comes from that too.

JAY RUDKIN

Of course. Thank you, Michelle. Now, for those of you who are less familiar with Virtru, and I promise this is not a Virtru presentation day, this is about real insights you can take back to your offices right away: we've been around since 2012. One of our founders, in fact, pioneered the Trusted Data Format, the open-standard encryption technology that underpins all of our tools, while he was working at the NSA. So it's extraordinarily secure.

We offer data-centric security and encryption solutions to protect sensitive data in common K-12 workflows. Think easy-to-use, easy-to-deploy tools for encrypted email, file transfer, and secure storage and collaboration. As you listen and ask questions today, perhaps you'll recognize gaps in your current tools or approaches. Please know we're here to help, and we'd be happy to schedule time with you afterward or at a later date.

Also, it's October again already. Wow. What does that mean? Two things. Budget planning season is in full swing, right? And it's Cybersecurity Awareness Month. One of this year's two themes is "Securing the Next 250," which essentially boils down to everyone needing to play their part in strengthening the country's infrastructure against cyber threats. You all are, of course, preaching to the choir here. The other theme is "Don't Make It Easy for Them," a reminder that many cyberattacks still succeed because basic security controls are missing or inconsistent. For school districts, the data we're talking about belongs to kids, by and large, and to your fellow staff.

Well, let's get into it. Oh, one more thing before we get going: we're going to send something out afterward, and please feel free to drop your questions in the chat as we go.

Now we're going to talk about what Ed Law 2-d actually requires. I'm going to start by asking you a question, Michelle. You've just described yourself as a bit of a unicorn, in that being the DPO is your entire job, which isn't the norm. I'm sure others on this call can attest to that. For the directors of technology who are also functioning as their district's DPO, what do you think they're most likely getting wrong just because they don't have the bandwidth to go deep on it?

MICHELLE KRIEGER

So, districts who are getting it wrong. I want to clarify: it's the district getting it wrong, not the director of technology. The districts getting it wrong are those that view the DPO role as strictly an IT role, or, even worse, as a one-person role. If I've said it once, I've said it a hundred times: data privacy and security is not the job of one. It's an organizational responsibility. Everyone plays a part.

In my district, when I say that, I often get challenged by, say, a cafeteria worker or a bus attendant, who'll ask, "How can I possibly be responsible for data privacy and security?" I explain that since email is how our district communicates and conducts business, and they have a school email account, they're responsible for managing that account appropriately and being good stewards of the district's data that they have access to, including things they don't think about, like bus routes or allergy information on students. That all needs to be protected. Understanding social engineering and reporting suspicious emails is super important too.

When a district looks at this as a one-person role, there's a problem. Think about the core functions of a director of technology: implementation of software, operations, innovation. The role is driven by technical performance, system reliability, and strategic improvement. In contrast, the core functions of a DPO are oversight, compliance, and accountability, driven by law, regulation, risk management, privacy, and governance. So you simply don't see a ton of overlap between those two roles, and you can't really expect one person to carry out both.

Another problem is the lack of checks and balances when the director of technology is also the data protection person. As the director of technology, you're implementing the software system, and then you're turning around as the DPO, with oversight over that, and saying, "Yeah, I did a great job." Again, it's an issue of checks and balances.

JAY RUDKIN

Those are interesting observations, and I can imagine they raise lots of questions at the district level for sure. Thank you, Michelle.

Now, when you look at what Ed Law 2-d actually says about encryption, where do you see the biggest gap between the law and what most districts presumably think they're doing?

MICHELLE KRIEGER

I think the biggest gap is the difference between data in motion and data at rest. Most district leaders focus on keeping data safe while it travels across the internet. Ed Law 2-d explicitly requires student and staff data to be encrypted wherever it sits. We can break this down into a few scenarios.

Scenario one: the district uses an encrypted cloud app, but a counselor or administrator exports something like a student roster or evaluation data into an Excel spreadsheet saved on their laptop or desktop, in a shared folder, or on a flash drive. That's a problem, because the moment that file lands on the local hard drive, it's rarely encrypted at rest. If that laptop is ever misplaced or compromised, you have an unencrypted data breach under state law on your hands.

Another example: you train your staff and faculty to look at the address bar, and if it shows HTTPS, they assume the software is compliant. Well, that padlock only protects data while it's in transit, moving over the web. It tells you nothing about whether the software company actually encrypts that same data at rest in its central databases or server logs.

This is where the district's approved software list becomes super important. I'm sure most of us have one. That list, with vendors who are vetted and engaged in a data privacy agreement, matters because you want your staff and faculty going not to just any software, but to the software you've vetted. When a DPO can properly vet these vendors, we can look at whether the vendor is actually encrypting the way your data privacy agreement says.

JAY RUDKIN

Very insightful. Along those lines, the vendor picture has changed dramatically. I think we discussed this.

MICHELLE KRIEGER

We did, for sure.

JAY RUDKIN

According to Education Week, third-party incidents went from about 4 percent to 30-plus percent of all K-12 breaches in just two years. I'm curious, and probably folks in the room are too, how has that changed what you're asking vendors before you sign a contract with them?

MICHELLE KRIEGER

Yeah. 4% to 32%. That statistic reflects what we're seeing on the ground every day, for sure. Our perimeter is no longer just our physical network, unfortunately. It's every cloud application connected to our staff and students. So, in response, here are some ideas we've considered, and I hope people on the call are considering them too.

The first thing is we're trying to move away from self-assessment. We're requiring verifiable proof, such as a SOC 2 Type 2 report or a standardized cybersecurity assessment, and maybe even penetration test summaries from our vendors. A SOC 2 Type 2 report is basically an independent report card showing that a tech vendor actually keeps customer data safe over a long period of time, usually, I think, three to twelve months. With a SOC 2 Type 1 report, your vendor shows they have good security rules on paper, which is all well and fine. But with a SOC 2 Type 2, what your vendor is proving is that they actually follow those rules every single day. Requiring to see that of your vendors is becoming pretty important.

Second, our district is considering tightening our contractual guardrails. We require non-negotiable incident notification windows, something like 24 to 48 hours max, so that we're not learning about a third-party compromise weeks after the fact on the news, which is a horrible place to find out.

And lastly, we've started to enforce strict data minimization, so vendors only get the bare minimum of our student data that's required to deliver their service. We also require explicit data deletion protocols and certifications when the contract ends.

I actually have a really quick story, if you'll allow me.

JAY RUDKIN

Please, go ahead.

MICHELLE KRIEGER

Okay, good. I'm hoping some people on the call remember the incident with AIMSweb. I'm going to say it was around 2019, 2020. That's when I was identified in my district as a data protection officer, and AIMSweb was one of the first vendors I had to deal with when it came to an unauthorized release of information. We were a district that used AIMSweb in the early teens, maybe 2010 to 2013 or 2014.

When the AIMSweb breach happened, I said to my superintendent, "I'm not real worried about this. Yes, we used AIMSweb, but we haven't worked with them for a while, so they shouldn't have any of our data, according to our data privacy agreement." No sooner had we had that conversation than, maybe a week later, we got notification that our information had indeed been released.

That led to a lot of mistrust of vendors in my world. I went back to the vendor and said, "This can't be the case that you have my data, because we don't use your products, and according to the data privacy agreement, you're supposed to destroy that data." So this whole game is becoming about trust, and we should be asking more of our vendors, because we're seeing incidents where, unfortunately, that trust has been broken. That's my personal story.

Ultimately, we view our vendors as strategic partners. We want to. But if a vendor isn't willing to be transparent about their security posture, their encryption standards, or their supply chain, then honestly, I don't think they're ready to handle our district's student data.

JAY RUDKIN

Yeah. Those are all brilliant insights, and it sounds like pretty useful tidbits that others on this call are likely pursuing and can certainly benefit from. Thanks for sharing that personal story. Those things kind of come back to bite you. Big surprise.

MICHELLE KRIEGER

Yeah. That's the Wayback Machine.

JAY RUDKIN

Hey. So, Michelle, if someone's watching this and realizing they may have gaps, what does the ten-day breach notification clock actually demand of a district? And how many of the folks on this call, and DPOs in general, do you think are ready to run that play?

MICHELLE KRIEGER

Yeah. So in New York State, we have to provide formal state notification. The district has to submit an official incident report to the New York State Education Department and the state's Chief Privacy Officer, detailing the breach type. You also have to include the estimated number of records exposed, which records and what specific PII fields were compromised, the affected individuals, and whatever steps we've taken to mitigate the situation. That all has to be reported within that ten-day window.

There's also the expectation that our vendors have, legally, up to seven calendar days to notify a district of a breach, and that can leave the district with a tight three-day window after they notify us to submit that report to the State Education Department.

It's also worth noting that when we talk about ten days, it's calendar days, not business days. The clock doesn't pause for weekends or snow days. I don't know where you're all listening from, but we do have snow days and holiday breaks. If an incident is identified on a Thursday before Thanksgiving, IT and the administrators have under 48 operational hours to coordinate. That can be tricky.

When we were having a brief discussion prior to this, we talked about how the cyber creeps of the world love to do this stuff on a Friday afternoon, right before a holiday break. So it makes it tough.

In addition, the State Education Department expects an outline of containment actions. They want to know specifically what the tech lead did and how they identified the exposure, and they want that information within the report. And then, of course, there's parent notification. Although notifying parents has its own separate sixty-calendar-day deadline, the ten-day state filing forces the district to identify affected data subjects really early.

JAY RUDKIN

I see. Well, that is an awful lot of demand.

MICHELLE KRIEGER

So here's the most important thing: districts need to have their plans in place. As a data protection officer, one of your responsibilities is creating an incident response plan and understanding, within that plan, this ten-day window, when parent notification needs to happen, and all of that. That's wonderful, but you need to make sure those incident response plans are practiced and understood by more than just you. That's why I'm a firm believer that, yearly or every other year, your team should practice your incident response plan with a TTX, a tabletop exercise, so that someone besides you understands all this.

JAY RUDKIN

Brilliant. That's not something we discussed beforehand, either. It brings to light, since we're both nursing head colds, for example: what happens if we're out? You're a small but mighty team of one, and you haven't shared these plans with others. The rule still applies. The clock doesn't stop just because the person who knows how to run the playbook is out.

MICHELLE KRIEGER

Yeah. Important. And in addition to the incident response plan, hopefully you also have a business continuity plan, so that if systems have to come offline or be shut down, you know how you're going to keep business moving forward without that system. Those business continuity plans are really important too.

JAY RUDKIN

Awesome. Well, thank you, Michelle. So we've got a law, in New York, that's explicit about protection at rest, not just in transit. We have a threat landscape that has moved decidedly toward vendors, right? 4% to 32%. And most of the people responsible for navigating that are doing it on top of an already full job. They're not unicorns like you. Let's talk about what closing those gaps actually looks like in practice, and transition into what encryption looks like in practice.

Speaking from experience, Michelle, something we hear from a lot of the districts we work with is that the moment data leaves their environment or their network, they feel like they've lost control entirely. Does that match what you see? And what's the most common situation where that happens, if it does?

MICHELLE KRIEGER

Yeah. It does match. The primary scenario where this happens is vendor subprocessor sprawl. A district signs a data privacy agreement with one of its primary software companies, but that vendor routinely passes data down to maybe two, three, or four secondary subcontractors for something like cloud hosting, analytics, or support. So it's not just that main primary software company you're worried about anymore. You're worrying about the subcontractors who are now hosting the data, or doing analytics or support. The moment the data hits those downstream partners, the district's visibility does indeed kind of vanish. It's a scary thing.

You don't need to go back too far to see an example. I'm sure there are a lot of people on this call who remember the PowerSchool breach of 2024. The massive breach was linked specifically to a third-party subcontractor credential vulnerability. The hacker, I think his name was Mike Lane, used a single compromised employee password to access a high-level maintenance access function. And because PowerSchool failed to mandate MFA, multifactor authentication, on the portal, the hacker gained wide-ranging access to the student information system without tripping any alarm. That's scary stuff, and it directly correlates with what I just said: it wasn't PowerSchool, it was a subprocessor that actually had the issue.

I think two other common triggers are, first, what we call shadow IT. A well-meaning teacher uploads a student roster into, say, an unvetted classroom app using their school email. That's an issue because, again, it's unvetted. I don't know what subprocessors they're using, and I haven't vetted them to make sure they're encrypting things the right way.

And then we also have what we call orphaned contracts. A district stops paying for software. Every year, I go through our software list with my director of technology, trying to use our money as wisely as possible and not have duplicate services across apps. Eventually, you're going to start dropping some of those, and you won't retain those vendors. I'm curious whether people are making sure they have a formal deletion request process for vendors they're no longer working with. That's really important. Probably every August, I get the list of who we stopped working with and start sending emails requesting proof that our data was deleted, because we're no longer using them. I've been burned once. You heard my story. I'm not going to be burned again.

It's something you have to think about. A signed contract creates the illusion of control. True protection requires that we track where the data actually flows, beyond the main agreement. So it's really important.

JAY RUDKIN

Sure. Those are all great points, and it tracks with what we see in the districts we work with. The assumption is that the platform is secure, so the data is secure, but the moment a file leaves that platform, that's no longer true. It's important, I'm sure you agree, to always be vigilant. Trust but verify, right?

MICHELLE KRIEGER

Ongoing.

JAY RUDKIN

The human element shows up in 62 percent of breaches. Amazing, right? So with all these tools we can put in place, we're still going to have the human element. It's omnipresent. A wrong attachment, a forwarded email, a staff member who didn't think twice, John Smith's IEP notice sent to the wrong John Smith's parents. How do you build something that accounts for the fact that people are going to make mistakes no matter what?

MICHELLE KRIEGER

So, if I were to build my entire security posture around my 2,000 staff, student employees, drivers, and administrators making zero mistakes, 365 days a year, I'd have a pretty failed system. Humans are humans. They get tired, overworked, rushed, distracted. The solution isn't to expect perfection. It's to build a system where a simple mistake doesn't turn into a catastrophic incident.

In our district, we address it through a three-part approach.

First, technical guardrails. We need to put safety nets directly into the staff's workflow. That means implementing data loss prevention tools, something that can catch sensitive attachments before they leave. It's really important to put automated protections in place that keep PII from leaving.

Second, we want to minimize the blast radius, so we operate with a zero-trust mindset. If an employee accidentally clicks on a credential-harvesting link, phishing-resistant MFA prevents unauthorized account access. If an endpoint gets infected, automatic isolation keeps it contained to a single device so the rest of the district stays out of trouble. Getting that taken care of is something else we look at.

And then, finally, psychological safety. The worst thing a staff member can do after clicking a bad link is hide that fact for hours out of fear. I don't want that to be the case. We foster a culture in our district where mistakes are met with a system response, not public shaming or finger-pointing. When staff know they can report an incident instantly without fear of retribution, our incident response team can contain the threat in minutes rather than hours or weeks.

Ultimately, we build security like automotive safety. I don't remember where I heard this, so I have to confess right now that it's not my analogy. But if you design crumple zones, seat belts, and antilock brakes into a car, then when a driver makes an error, everybody still walks away. That's how we treat cybersecurity. Put those safety features in place, and then when there's an incident, everybody can walk away.

JAY RUDKIN

Awesome. Some pretty brilliant takeaways in there for the folks on the call. I appreciate you sharing.

At Virtru, when we think about end-to-end protection, it can help mitigate some of these questions. Of course, a lot of the questions we ask, we ask because your audience wants to know and can use some assistance, and we can also help with some of these things ourselves. With Virtru solutions, the data protection travels with the data itself, which helps minimize the burden on staff having to remember. That's along the lines of the DLP you described.

Now, when we met before this call, you mentioned records retention and LGS-1 as where your head has been lately, because we wanted to know what's new in your world. That intersection of what you have to keep, what you can get rid of, and how encryption plays into that: where does that fit into the DPO's compliance picture going forward, do you think?

MICHELLE KRIEGER

Yeah. It was an interesting conversation when we first started chatting, and it's been on my radar since late summer. To me, the intersection of LGS-1, encryption, and data protection comes down to one principle: you can't breach or misuse data you don't have.

Historically, records retention and data privacy lived in separate worlds. In my district, before I began here, records retention lived in the business and HR departments and didn't have anything to do with data protection. Records management was about paper and boxes, the many boxes in the basements that hold all the records, while privacy was about your network settings and things like that. Going forward, I think the DPO needs to bring themselves into this conversation to unify the two and talk about data minimization.

First, LGS-1, our guidance in New York State, is a legal road map that tells us when we can get rid of things. It tells us what we must keep, but more importantly, it gives us explicit authority to dispose of records we no longer need, because we don't need to be holding on to decades and decades of old student records or expired personnel files beyond what the regulations mandate. That's really important to understand first.

Secondly, encryption protects data while it lives within that retention period. Under Ed Law 2-d and the NIST CSF standard, encryption is nonnegotiable for PII. But encryption isn't a substitute for disposition. An encrypted server full of expired data that sits forgotten in a closet, or somewhere, is still at risk. So the DPO should move forward and work with their director of technology to build something automated and policy-driven that takes data life cycles into account across our systems. That way our student information systems, Google Workspace, and third-party cloud apps automatically get flagged when data expires. That would be wonderful, because then no one has to keep physical eyes on when that deadline is. We just get the notification and can get rid of the data. As I said earlier in this conversation, you can't breach or misuse data you don't hold on to. So that's important.

JAY RUDKIN

Fascinating. Michelle, I really appreciate you being so open about all of these things. What sticks with me, among other things, is that the law isn't ambiguous. Under Ed Law 2-d, student PII has to be protected after it leaves your network, not just while it's moving through it. And most of the people responsible for making that happen are doing it alongside ten other jobs. So, kudos to you.

I want to make sure we land one practical takeaway before we go to questions. Michelle and our team put together a DPO encryption cheat sheet that maps directly to Ed Law 2-d. I'm going to drop the link in the chat now, and it'll also be in your follow-up email. Let's see if I can drop it in the chat. I can use technology too, a little bit.

MICHELLE KRIEGER

Good for you. Look at you go.

JAY RUDKIN

I'll drop these in there too. Michelle's LinkedIn page. Sorry, guys. Say paste. There we go. And finally, one more thing to drop in there. So I guess I've got three takeaways for you. Copy.

MICHELLE KRIEGER

I love it. If anybody on the call has ever been to one of my conference sessions, I am really good about giving it all away. So this fits right in line with a session at a conference for me, Jay. Give it all away.

JAY RUDKIN

And you do.

So, Michelle's LinkedIn page, the cheat sheet with some practical takeaways, and, as Michelle mentioned early on, her latest privacy newsletter, just published today. That's your invitation to subscribe. We really appreciate you, Michelle. We're going to open up to questions and see what folks have.

MICHELLE KRIEGER

Yeah.

JAY RUDKIN

Alright. I'm going to throw one out there that I know is probably an unasked question folks may have, and some may still trickle in. For a DPO who's also a director of technology, where do you actually start when you're trying to get your arms around this?

MICHELLE KRIEGER

Yeah. I actually work with a lot of new DPOs, so I get this question a lot: "Hey, I was just named the DPO for the district. What do I do now?" I always start them off with a data inventory. You're going to find shadow IT out there. You need to know what software you're using and what data is going to those software vendors and into those systems, and then map where the student and staff PII lives: which systems collect it, and which unauthorized apps staff have signed up for on their own. We can't govern or protect what we don't know about, so getting a clear picture of what software products you're using is really important.

Next, check that you're only sharing with those vendors the necessary information they need to do their work.

And then, finally, first and foremost, I always suggest looking into what the district already has, or needs to have, for a comprehensive training and awareness program that goes beyond your one-a-year compliance video, where people turn the video on, probably walk away from the machine, come back, take the quiz, and hope to get most of the questions right so they don't have to do it again. A comprehensive program involves campaigns throughout the year where you bring up different topics. October is a perfect example, where you can squeeze in all kinds of cybersecurity content because it's Cybersecurity Awareness Month. In January, there's Data Privacy Week. In springtime, I always do a spring cleaning, keeping your virtual hygiene in order, and things like that. I have lots of ideas for how to keep data privacy and security in your employees' minds for most of the year.

JAY RUDKIN

All very good tidbits and tips there, Michelle. Thank you for sharing.

Jamie mentioned they're not a LinkedIn user. Is there a way for someone to subscribe to the newsletter without being on LinkedIn? I'm just curious.

MICHELLE KRIEGER

I have other socials, like Facebook, that I post on, so I'm not sure if Jamie is on Facebook or any other social media, but I tend to be there too. This link isn't just on LinkedIn. It's on some other social media as well.

JAY RUDKIN

Thank you. Good question. Let's see here. Any other questions? It's okay.

Alright. Just to restate for those who might not have joined, or joined a little late: we're very appreciative of Michelle, of course, but for those who don't know us too well, Virtru offers data-centric security solutions to protect sensitive data, which can help you become compliant, as you might imagine. Again, think easy-to-use, easy-to-deploy tools for encrypted email containing PII, file transfer containing PII, and secure storage and collaboration solutions. As you listen, perhaps you've come up with questions, or maybe you'll have some afterward, or you recognize some gaps in your current tools or the way you approach things. Again, we're here to help.

I've worked with Michelle now. This is our second year working together. She just gives, right? She's always going to help answer questions, and we'll do the same. We'd be happy to schedule time to meet with you about the Virtru solutions if they make sense for you to consider at a later date.

So, again, thank you all for coming. Make sure to connect with Michelle on LinkedIn if you're open to doing so. Of course, no pressure.

MICHELLE KRIEGER

I did put my email in the chat. That's my direct school email. Anybody on this call who emails me, I can send Jamie a link to get to the newsletter. No big deal.

JAY RUDKIN

Fantastic. And I want to say thank you, Michelle, and thank you to everyone who joined today. The recording and the cheat sheet will be in your inbox sometime later this afternoon. Again, thanks to everyone who came, and enjoy the rest of your day. Have a great fall.