Alberta’s privacy commissioner is advocating for enhanced security protocols in schools following a cybersecurity breach that exposed highly sensitive data of numerous students last year.
A recent report from the privacy commissioner highlighted that 33 public, charter, and Francophone schools and school boards reported being impacted by an online breach involving the education software provider PowerSchool. This platform is utilized for storing various student data.
The breach resulted in the exposure of personal information such as names, birthdates, addresses, social security numbers, academic records, and medical details, including diagnoses and medications, affecting students, parents, and staff members.
Several school authorities, including the Calgary Board of Education, Rocky View Schools, and public school divisions in Red Deer, Medicine Hat, and Fort McMurray, were affected by the breach. The report revealed that most school authorities failed to include adequate privacy and security provisions in their contracts with PowerSchool, as required by provincial privacy regulations. Additionally, many lacked policies to effectively oversee PowerSchool’s security measures.
Alberta’s information and privacy commissioner, Diane McLeod, emphasized the responsibility of school boards to ensure the security of students’ personal information, despite identifying issues with PowerSchool’s security measures.
In response to the breach, the federal privacy watchdog announced the discontinuation of its investigation into PowerSchool, citing satisfaction with the company’s response and commitment to enhancing security measures.
Furthermore, a 20-year-old individual from Worcester, Mass., named Matthew Lane, was sentenced to four years in prison in connection with the breach that exposed sensitive data of over 2.7 million current and former Canadian students, including more than 700,000 students in Alberta.
The report highlighted security vulnerabilities within PowerSchool, indicating that stolen credentials from a contractor were used to gain unauthorized access to the customer support portal and subsequently the student information systems. McLeod raised concerns over the platform’s inadequate security measures, such as the absence of mandatory multi-factor authentication and insufficient restrictions on remote access.
McLeod’s report proposed recommendations for school boards, PowerSchool, and the provincial government to enhance data protection measures. Among the suggestions were the need for school boards to have resources and expertise to establish effective privacy policies, monitor safeguards used by vendors like PowerSchool, and receive guidance on safely integrating educational technology in classrooms.
The report also called for the province to provide support to school boards through grants or funding to ensure the safe utilization of education technology. Alberta’s education minister, Demetrios Nicolaides, expressed intentions to strengthen procurement processes and offer guidance to school boards when engaging with technology vendors.
McLeod emphasized the need for collaboration with international companies like PowerSchool to develop educational technology that upholds student privacy. The Calgary Board of Education expressed its commitment to reviewing the report’s recommendations for process improvement.
In conclusion, the report underscores the significance of robust security measures in safeguarding student data and advocates for a collaborative effort to address privacy concerns in educational technology.