Alberta’s Information and Privacy Commissioner Diane McLeod is addressing concerns following a significant data breach involving the PowerSchool platform, which has impacted students and educators across the province.
The Office of the Information and Privacy Commissioner (OIPC) has so far received 31 breach notices from Alberta educational institutions reporting unauthorized access to personal information stored on PowerSchool, a cloud-based platform widely used by schools worldwide. Some notices also included the personal information of educators.
According to details from one breach report, the compromised data includes students' names, phone numbers, dates of birth, genders, grades, school-issued email addresses, Alberta student ID numbers, and school-issued ID numbers. Health-related information, such as allergies, medications, medical conditions, personal health numbers, physician contact details, and guardian information, was also accessed.
“I take the privacy rights of Albertans, and in particular children, very seriously,” said McLeod.
“We are in the beginning stages of our review of these breach notices and will be working with the affected educational institutions to mitigate the risks to those affected by the breach. We are reviewing the breach notices as they come in to determine the total number of Albertans affected, but it is clear that it is a significant number, including many students. I am also working with my counterparts throughout Canada to address this breach.”
The breach stemmed from unauthorized data exfiltration through one of PowerSchool’s community-focused customer support portals, according to a notice posted on the company’s website. PowerSchool is offering credit monitoring and identity theft protection to affected individuals.
Albertans who have received a breach notice and have questions are advised to contact their educational institution. For more information on privacy rights, they can visit the OIPC’s website.
