British Columbia’s Ministry of Education has “misplaced” a hard drive containing records on 3.4 million people, including sensitive information on students, teachers and children who were in provincial care.
According to a government statement released Tuesday, the records contained on the missing external drive are:
- 3.1 million records on all students involved in the B.C. and Yukon K-12 education systems between 1991 and 2009, including names, postal codes, birthdates, grades, personal education numbers and more.
- Further information on 1.85 million of the B.C. students, including genders, aboriginal statuses, special needs statuses (including mental illnesses), credentials achieved, high school grade point averages and more.
- 188,000 records on those who were enrolled in Grade 12 between 1986 and 1989, including student numbers, names, birthdates, genders, graduation statuses and GPAs.
- 512,000 records on those enrolled in public post-secondary institutions between 2002 and 2009, including education numbers, birthdates, genders, aboriginal statuses, high school GPAs, post-secondary student numbers, citizenships and more.
- 252,000 records on students who applied for and/or received financial aid between 2000 and 2008, including education numbers, birthdates, genders, family information and more.10,000 records on children in provincial care in Sept. 2000, including full names, birthdates, genders and “case file information”
- 9,000 records on individuals involved with the Ministry of Children and Family Development before 2006-07, including information on health and behavioural issues, adoption statuses and intellectual disabilities.
- 1,000 personal education numbers, birth years and graduation dates for cancer survivors involved in a study on their education outcomes.
- 825 records from teachers surveyed in 2003, including first names, genders, home addresses, private phone numbers and comments on retirement plans.
- 169 pieces of teacher correspondence, including full names, email addresses and comments “sometimes of a personal nature.”
- A number of other records. The full list is available here.
The unencrypted information was contained on a black Western Digital external hard drive created in 2011. The Ministry of Education was unable to find the drive during a recent data storage review, according to the statement from the Ministry of Technology, Innovation and Citizens' Services.
The ministry said there no indication that data from the missing hard drive has been accessed and the risk is thought to be low, because the data does not include banking information, social insurance numbers or driver's licence numbers.
However, Technology, Innovation and Citizens' Services Minister Amrik Virk said that the incident “should never have happened.”
“I have directed the province's chief information officer to undertake a review to make sure that our privacy protection policies and procedures are as robust as they possibly can be,” Virk said
B.C. Information and Privacy Commissioner Elizabeth Denham released a statement Tuesday, explaining her office was informed of the “disappearance” of the drive on Friday. The office has launched an investigation.
“It is deeply concerning to learn about another case of a major privacy breach involving unencrypted data,” Denham said.
“When citizens entrust government with their personal information, they expect that it will be protected as required under provincial privacy law,” the commissioner went on.
“The magnitude of this breach is especially troubling.”
The government statement said concerned citizens may call 250-387-6121 in Victoria, 604-660-2421 in Vancouver or 1-800-663-7867 from elsewhere.
