Avilés questions OTI relationship and procurement process

I wanted to also ask, I know OTI is not here, but in your perspective, what role does the chief privacy officer in OTI play in the operational process?

And does DOE utilize a master service agreement procurement process for NYC schools?

Thank you.

I'm going to bring in our data privacy to speak on his role and his work with OTI.

Yeah, I can speak a little bit.

Thank you for the question about our relationship with OTI.

We work closely with OTI when it comes to the IRMA process and the data privacy and compliance process.

One of the parts of that process is to have third-party vendor products undergo a cloud review conducted by the Office of Technology and Innovation.

And we will also work closely with OTI and the Chief Privacy Officer's office at OTI in responding to any cybersecurity incidents.

We'll work closely together in sharing information about the incidents and make sure we're responding accordingly.

I defer to somebody else on the contracting aspect of that question.

Anybody else?

Master service agreement procurement process?

I'm going to have to get back to you on that.

I don't want to misspeak on that.

Okay.

OTI has a citywide AI governance, the AI action plan, and the generative AI use guidance.

Does OTI's overall citywide guidance bind the DOE, or does the DOE believe itself to be outside of OTI's authority?

I don't believe we see ourselves as outside of OTI.

Would you have any more insights to share?

Yeah, I mean, I think we generally comply with OTI's guidance when it comes to issues like cybersecurity and data privacy.

And if there's a conflict with OTI's suggestions or guidance, who governs?

I think it would probably depend on the subject matter area.

I mean, for example, there's the city's identifying information law, which is administered by OTI.

That's something that the DOE is actually not subject to because we're subject to separate laws under FERPA, New York State Education Law 2D.

So I think it would depend on the subject.

Depends on subject.

Okay.

Thank you for clarifying.

Yeah, I would just add a bit to this.

We, to the extent possible, love to be consistent with what OTI wants, both technically, legally, et cetera.

Every once in a while, as Dennis mentioned, there's things that are over and above on the educational setting.

Also, there's the...

Situation where the DOE is really an agency of the state and the mayoral control, it can be removed at any point and therefore we need to be able to operate independently.

But we do like to follow what they're doing.

We work with their cyber command a lot on general

security, and then specific incidents, we work cooperatively together.