Privacy Breach Notification – Dec. 20, 2016
School District 91 – EBUS Academy
On December 11, 2016, School District 91 discovered a privacy breach affecting approximately 16,000 current and former EBUS Academy students. From early September 2016 to December 11, 2016, student report cards were accessible by internet searches. School District 91 is not able to confirm whether or not any student personal information was actually accessed however, upon discovery, the folder containing the report cards was immediately removed from public access and the technology department worked with Google to remove cached copies of the report cards from the server. We are advised that the information is no longer available on the Internet.
Since the extent of Internet searches to access report cards is unknown, we are notifying the community of this privacy breach in order for students and families to be aware of and take appropriate steps to protect their privacy interests.
The folder that was inadvertently made available on the Internet contained report cards issued since 2012. The information contained within a report card and accessible during this time period includes:
- Legal first and last name of the student
- Personal Education Number (PEN) – (more information on PENs can be found HERE
- EBUS Academy Information as well as name of Home School (cross enrolled students)
- Enrolled courses with grades, percentages and teacher comments
- Confirmation of the existence of Individual Education Plans (IEP)
School District 91 has informed both the Ministry of Education and the Office of the Information and Privacy Commissioner (OIPC) of this potential privacy breach.
On December 12th a third party security firm was contracted to conduct an audit of the ‘MY.EBUS.CA’ server to ensure that no other private information was breached and to identify privacy vulnerabilities. It was confirmed that the incident was isolated and steps are underway to ensure increased security policies and processes.
School District 91 is committed to ensuring the privacy of its students and their families. Additional measures are being undertaken to ensure that this type of data is firewalled and housed in servers encrypted with security certificate technology.
Whenever a privacy breach including personal information occurs it is prudent for affected individuals to be alert to any suspicious activity and to consider or take steps to prevent risks such as identify theft. For more information about how to protect yourself following a privacy breach, there are useful resources listed on the Privacy Commissioner’s website at: https://www.oipc.bc.ca/guidance-documents/1445.
Parents and students that have further questions are welcome to contact the School District or if you are not satisfied with steps taken by the School District you may complain to the OIPC as per below:
School District 91
PO Box 129
|Office of the Information and Privacy Commissioner for BC|
PO Box 9038 Stn. Prov. Govt.
Victoria B.C. V8W 9A4
Superintendent of Schools