The Commissioner notes the work her office is doing and suggests possible courses of action for those affected
The Office of the Information and Privacy Commissioner (OIPC) of Alberta has received 31 breach notices to date from Alberta educational institutions about unauthorized access to personal information of students attending those educational institutions, which were using the PowerSchool platform. In some cases, the personal information of educators was also mentioned in the breach notices.
PowerSchool is a cloud-based platform used by students, educators and educational institutions around the globe. According to a notice posted on PowerSchool’s website, there was an unauthorized exfiltration of personal information through one of its community-focused customer support portals.
According to one breach notice received by the OIPC, the personal information of students that was accessed included names, phone numbers, dates of birth, genders, grades, school-issued email addresses, Alberta student ID numbers, and school-issued ID numbers. The health-related information consisted of information about allergies, medication and medical conditions, as well as personal health number, physician contact information and guardian information.
“I take the privacy rights of Albertans, and in particular children, very seriously,” said Information and Privacy Commissioner Diane McLeod. “We are in the beginning stages of our review of these breach notices and will be working with the affected educational institutions to mitigate the risks to those affected by the breach. We are reviewing the breach notices as they come in to determine the total number of Albertans affected, but it is clear that it is a significant number, including many students. I am also working with my counterparts throughout Canada to address this breach.”
For those Albertans who received a notice about the breach and have questions, please contact the educational institution that provided the notice to you. For information about your rights under Alberta’s privacy laws, please visit the OIPC’s website.
Information provided to the OIPC indicates that PowerSchool is offering credit monitoring and identity theft protection to individuals affected by the breach. Please contact PowerSchool for information about that offer.
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s three access to information and privacy laws, the Freedom of Information and Protection of Privacy Act, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.
For more information:
Elaine Schiman
communications@oipc.ab.ca
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
Mobile: (587) 983-8766