De La Rosa questions privacy training completion rates

Thank you, co-chair.

I want to talk about this state controller audit that was raised previously by Councilmember Aviles.

You familiar with it?

Yes.

Okay, good.

That was an easy one.

You spoke about the training previously, about the required training.

Part 121 requires annual privacy and security training for employees with access to personally identifiable information, correct?

That's correct.

Okay.

And the DOE requires employees to complete annual privacy trainings, correct?

Yes.

So the report, the controller found that in 2024, only 73% of employees completed that training.

Is that correct?

That's right.

The audit found the DOE did not review the completion list to verify that employees with access to personally identifying information had completed the training, correct?

That was the finding in the audit, yes.

That was, so it is correct.

So the DOE...

Could not prove that every employee with access to student personally identifying information completed the required annual training.

True?

Yes.

Okay.

So that was from 2024.

Does the DOE know today whether employees that are not completing annual trainings have access to personally identifying information?

No, I mean the difficulty with this and this is

is an area where we actually, as I said before, we actually exceed what's required by Ed Law 2D.

Ed Law 2D requires training for anyone with access.

We require it for all employees.

The difficulty that we have with this is we do not have a list of all of our employees that identifies in that list whether they have access to personally identifiable information.

But as part of your policy, you require all employees to...

To take it regardless, yes.

Thank you.

And what percent of employees have taken this training?

Our most recent numbers from the most recent school year, we had 138,000 employees complete the training.

What percent is that?

I would have to get back to you on the exact percent.

I think it's out of roughly 150,000 or 160,000 employees.

So that's not 100.

It's not 100%.

But I mean, if your policy is all employees and you can't identify which employees have access to personally identifying information, I guess it makes sense to just train all employees.

And that was in a report issued two years ago.

So even with your own numbers, and your own requirements, not every employee

gets this training, correct?

Every employee receives the training.

Whether they actually complete it is a different question.

I mean, we strive to have 100% completion, and we're working towards finding ways to make sure that we get closer and closer to that number.

It's extremely difficult.

Given the number of employees we have, we have employees who are going out on leave, employees who are coming on to the table.

You said roughly 130,000 out of 160,000 completed?

Was that what you tested?

138,000 roughly.

Out of 160,000?

Ballpark, yes.

Okay, so you have 22,000 teachers going on leave, not completing it?

Not necessarily teachers, just DUE employees.

Sorry, DUE employees, you have 22,000 teachers a year going on leave?

Well, there's some flux in that number, but again, not all of those employees necessarily have access to personal identifiable information.

Right, but...

You don't know which employees have access.

So you made a smart decision to require all employees to complete this training, but it doesn't sound like a requirement.

It sounds like a desire.

So what steps are being taken to ensure that the adults, the employees that have access to this information, get the training that you require?

It is a requirement.

Whether or not we can actually make sure that everybody 100% completion is the challenge.

We send out the annual training every fall, the beginning of every school year.

We give a deadline to complete the training.

We send out multiple reminders to staff who have not completed the training.

We'll send out reminders even after the deadline passes, continuing to send reminders along those lines.

We part of the updates to the Chancellor's regulations.

A20 was to require supervisors to make sure that their supervised employees are completing the training.

And when were those updates to the Chancellor's regulations made?

Those were made in May of last year.

So the only change between 2024 when this report was released and they said that this was an issue and now is that you told supervisors to tell their employees to complete the training?

That was a change in the regulation, but we're continuing to try to increase our training completion percentage through updating awareness, guidance.

We send out principals digest messages, superintendent guidance, superintendent digest messages.

So we're constantly trying to make sure that our staff are aware of their obligations and that they're meeting those obligations.

It sounds like a huge, it just sounds like a huge gap.

And this is a report from two years ago.

Yes, please, Dr.

Chang.

Chair, let me jump in.

Please.

And I want to say that, you know, as somebody who supervises our superintendents and therefore our school-based staff, we take full responsibility to ensure that those adults who are working with personal identifiable information,

we are doing everything in our power to make sure they're getting that training.

And that is the priority staff, and we will work with our team internally to make sure that that gets done.

Okay, do you have goals for yourself?

I mean, you can call them smart goals, whatever acronym you want to use, but you're at like 80-something percent now.

It was 73%.

two years ago, do you have goals that you're setting for yourself in terms of ensuring that this, as we know, AI is changing rapidly, it's getting into the classrooms, more and more vendors, I mean, this is important.

So what are the goals that the DOA has set for themselves to ensure that it is actually a requirement

And to me, that means 100% compliance.

Yeah, I think the goal is 100% completion.

I mean, that's what we're striving for.

And we recognize the difficulty in getting to that number, but we're constantly trying to get to that number.