Ontario and Alberta’s Information and Privacy Commissioners have released their findings on a significant privacy breach involving PowerSchool, an education technology platform used by schools in both provinces.
The breach, which affected millions of Canadians, underscores the critical need for educational institutions to uphold stringent standards in protecting sensitive personal information of students and educators.
The investigations revealed several common shortcomings among educational bodies:
– Absence of essential privacy and security provisions in contracts with PowerSchool.
– Inadequate policies to monitor and oversee PowerSchool’s technical and security measures.
– Failure to restrict remote access to student information systems to necessary instances.
– Lack of comprehensive breach response plans.
In response, the commissioners recommend that educational institutions:
– Review and renegotiate agreements with PowerSchool to include necessary privacy and security clauses.
– Implement effective monitoring of PowerSchool’s security practices.
– Limit remote access to student information systems strictly to essential cases.
– Develop robust breach response protocols.
Additionally, the commissioners urge their respective governments to support the education sector by enhancing the bargaining power of educational bodies in negotiations with edtech providers and providing technical guidance to assess the privacy and cybersecurity standards of these vendors.
This incident serves as a stark reminder of the importance of robust privacy practices in the education sector, especially when engaging with third-party service providers.
Locally, the Peace River School Division, the Holy Family Catholic Regional Division, the Northland School Division and the Fort Vermilion School Division, use Powerschool.
Keith Hopper, Trending 55
