Proposed class action targets school board over Rosemere High School data breach

A class-action lawsuit request has been filed in Quebec Superior Court against the Sir Wilfrid Laurier School Board following a data breach last week involving the personal information of parents at Rosemere High School on the North Shore of Montreal.

On July 2, an email was sent to all parents at the high school containing their personal information on an Excel spreadsheet, including the social insurance numbers, dates of birth and other personal information of over 2,000 parents.

The law firm handling the class action lawsuit, Lambert Avocats in Montreal, told CTV News that several parents reached out to the firm expressing their concern about the data breach.

• READ MORE: Thousands of parents’ personal information leaked in Montreal-area high school security breach

“The school and school board were grossly negligent in the protection of very sensitive data,” Inès Drolet of Lambert Avocats law firm told CTV News.

“There were serious shortcomings regarding the protection of personal information, which justifies compensatory and punitive damages.”

According to Drolet, the data breach violated one of Quebec’s laws, which is an act respecting access to documents held by public bodies and the protection of personal information.

The lawsuit seeks compensatory damages, which are to be determined, and the punitive damages are a minimum of 1,500$ per parent.

Parents affected by the data breach are automatically enrolled in the class-action lawsuit, Drolet says.

School board offers credit monitoring

In a statement to CTV News, the Sir Wilfrid Laurier School Board said it was providing three years of credit monitoring and identity theft protection services at no cost to parents affected by the data breach.

“While credit protection services are being arranged, we continue to recommend that affected individuals place a free credit lock on their credit file with Equifax Canada and TransUnion Canada as an added precaution,” the statement, signed by chairperson James Di Sano, said.

Drolet says while this move from the school board is a step in the right direction, it is not sufficient considering the nature of the information leaked.

“Whether it was a human error or not, excuses nothing,” Drolet told CTV News.

“No single person should ever have been in a position to make this kind of mistake if all the proper measures had been in place, precisely, to prevent it.”

Maxeen Jolin, assistant director of communications for the school board, told CTV News they are aware of the class-action lawsuit but remain focused on finalizing the credit monitoring services with Equifax.

Following the first email, two other emails were sent out to parents by the school board.

The last one, asking parents to fill out a form certifying that they had deleted the email and that no copies were made, used or shared. They gave parents a July 4 deadline.

Jolin says the school board is focused on obtaining those documents.

“These forms remain an important part of our mitigation efforts, as they help us verify that the information has been deleted by all,” Jolin told CTV News.

The law firm says this move by the school board was an inadequate response to the data leak.

“The school board has no way of ensuring that all of the 2,000 parents involved have actually erased the email and its attachment,” Drolet told CTV News.

“The information is already sitting in the unprotected computers and mail inboxes of 2,000 people, with no protection whatsoever.”

Parents speak out

Several parents who contacted CTV News said they were not happy with the school board’s response to the data breach.

CTV News agreed not to identify the parents due to privacy concerns.

One parent told CTV News that the credit monitoring the school board has offered is a step in the right direction, but more is needed.

“It’s not just identity theft, this is also a safety issue for kids,” they told CTV News.

“Our addresses were on that spreadsheet. The safety of our kids has been compromised. The credit monitoring will protect me for three years, but after that, then what?”

Several other parents also told CTV News they have or will seek legal advice outside the class-action lawsuit.

Although parents affected by the data breach are automatically enrolled in the class-action lawsuit, the law firm is asking parents to reach out if they have additional information they would like to share.