School board loses memory stick with employee data

 The private information of thousands of Edmonton Public School Board employees has been missing for more than three weeks, CBC News has learned.

In a massive privacy breach, a USB memory stick containing information, including resumes and employment records of about 7,000 employees, was lost on March 22.

The stick was used by a school board computer technician working in human resources to download the data, but then he lost it.

The school board has recently sent out letters to the affected employees, advising them that their private information — possibly including banking data — may have gone astray.

"We've informed all the individuals," said Cheryl Oxford, a spokeswoman for Edmonton Public Schools. "We've provided our contact information. We've provided them information in terms of how to monitor their personal financial information."

Provincial privacy commissioner Frank Work said the school board violated its own policies.

"First of all, according to school board policy, you're not supposed to use an unencrypted stick," said Work. "They did."

"Second of all … they're supposed to keep a list of what they download … onto a portable device, like a stick. They did not. And the third way they breached their own policy was they had kept too much information too long."

Work said he sees a privacy breach like this almost every month. But he said there is no point in penalizing the board financially because it has already spent thousands of taxpayer dollars to sort out the mess.

"This breach cost them a heck of a lot of money," said Work. "We're talking about, let's see, we're talking about probably several thousand people here. This is a big-ticket item."

He said he's going to ask the board for a full accounting of what it cost to deal with the problem.