Dinowitz questions DOE on subcontractor data privacy and audit records

I'll now turn it over to Chair Dinwitz.

Thank you, Chair Krishnan.

Can you wait?

Can you stay?

I just, I figured while you're here.

Might as well say, I just want to clarify, since we were talking about data confidentiality, that we have programs like Amira that I believe contract with Claude.

for their programming, is that correct?

I'm not familiar off the top of my head of who Amir contracts with for their subcontractors.

Okay, let's pretend it's Anthropic, or let's pretend any of these companies then contract with another company, let's say like a ChatGPT or a Google.

I want to confirm your data

policy extends to the company like a mirror that you're contracting with does it then extend to the company that they are then contracting with

yes absolutely thank you very important question and it's not just a policy it's the actual contractual agreement the data processing agreements that we have with these vendors

There's terms in that agreement that require those third-party contracts that we contract with,

that they require the same data privacy and security terms that we require of them, that they implement those same strict requirements on any sub-processor that they would use to provide the service.

And you are privy to those contracts?

The contracts between the data, our contractor and their sub-processors?

Yeah.

No, no.

I mean, we could, as a matter of course, no, we do not collect all of the contracts between our third-party contractors and the sub-processors.

How do you, I mean, how do you verify?

That the student data isn't being misused by the other company that you don't directly contract with.

We do have continuous monitoring that we conduct of our vendors.

We have terms in our data processing agreements that permits us to conduct audits, to collect different reports like SOC 2 type 2 reports for vendors to make sure that they're adhering to those standards.

And we have ability under our data processing agreement to collect that information at any time.

How many audits have you conducted in the 26 to 27, 25, 26 school year?

I don't have that information offhand.

Have you conducted any audits in the 2025-26 school year regarding data privacy?

I would have to go back and look at our records on that.

Okay, can we find that out during today's hearing?

I don't know if we'll be able to do that today, but I'm sure we could find that information and get back to you.

Okay.

Please find that out today.

That's very pertinent to the topic we're discussing.

So I would appreciate that very much.

Thank you so much.