SOI #017 Data Removal and Privacy Protection Platform

The New York State Unified Court System, Office of Court Administration Division of Technology and Court Research (hereinafter “UCS”) is issuing this Solicitation of Interest (“SOI”) as market research to identify qualified vendors capable of providing a comprehensive data removal and privacy protection platform for UCS judicial staff as further outlined herein. This SOI may not result in a contract award. Vendor responses to the SOI will be independent of, and have no bearing on, any future competitive solicitation issued for the same or similar service. Background Information Judicial and non-judicial employees face increasing privacy risks due to the widespread availability of personal and professional information online. Data broker websites, search engines, social platforms, and other publicly accessible sources often expose sensitive information, increasing the risks of harassment, impersonation, doxxing, and targeted threats. To comply with the requirements set forth in the New York State Judicial Security Act, Article 22-C, Judiciary Chapter 30, Section 859, the UCS is seeking a vendor capable of delivering a comprehensive privacy protection platform that combines advanced monitoring technology with hands-on human expertise to proactively reduce digital exposure and mitigate evolving online threats. Required Platform Capabilities UCS seeks responses from vendors capable of providing the following: 1. Continuous Monitoring Technology that continuously scans the web for exposed personal and organizational data. Ongoing refinement of removal techniques to ensure high success rates of data removal. Proactive monitoring to identify new exposures as they arise. 2. Reporting and Transparency Detailed reporting for both individual users and administrators. Dashboards providing visibility into exposure levels, removal status, and ongoing mitigation efforts. Real-time or near-real-time tracking of remediation activities. Ability to submit custom removal requests. 3. Vendor Subject Matter Expertise Demonstrated history and depth of experience in data privacy and online exposure mitigation, with customers of a similar size, and with similar business, to that of the NYS Unified Court System. Proven ability to adapt to evolving digital threats and data broker practices. Market-leading technology supported by specialized privacy expertise. 4. Human-in-the-Loop Remediation Manual review and validation of removal actions. Direct engagement with data brokers and site operators. Search engine audits and verification of takedowns. A structured process pairing automated detection with expert human oversight, for both end users and administrators. 5. Administrative Controls Robust administrative dashboard. Reporting on data broker removal and membership. User account management functionality. Delegated access to allow authorized personnel to manage accounts on behalf of users. Multi-tenant architecture enabling organizational partitioning of user access. 6. Data Ownership and Control Clear policy establishing that customers retain ownership and control of all data provided to the platform. Ability for users or administrators to determine which data are removed and what remains publicly accessible. 7. Security Standards SOC 2 Type 2 certification required ISO 27001 certification preferred. Secure individual user accounts. Adaptable dashboards and direct access to reports. Demonstrated adherence to industry-standard data security practices. Advanced Functional Capabilities Vendors that can provide the following enhanced services are encouraged to respond: A. Custom Removal Requests and Full-Service Support B. Search Engine and Data Broker Removal C. Contiguous U.S.-based 24/7 Human Support and Privacy Guidance Responding to this SOI Interested vendors must submit 1) the completed Required Response Form and 2) a Letter of Interest including brief responses to the components listed below to the email address listed on the Required Response Form. Letter of Interest Legal business name, address, and primary contact information. Years in business and organizational structure supporting service delivery. Maximum number of supported users for service delivery. Description of relevant experience providing online data removal and privacy protection services within the past five (5) to ten (10) years. Description of monitoring technology and methodology. Description of human review and validation processes. Description of security certifications and data protection controls. Explanation of administrative functionality and multi-tenant capabilities. Description of search engine suppression and custom removal processes. Service level commitments, including response times and availability. Required Response Form This form is required in addition to the Letter of Interest. Please complete every column on this form. Letters of interest and this form are due by 2pm on Friday, March 20, 2026 to Kiersten Mendrysa at [email protected]. See the Required Response Form contained within the uploaded documents.