School board broke privacy law in computer theft case: report

The largest school board in Newfoundland and Labrador breached privacy legislation, according to a ruling made in the wake of computer thefts from the board's offices this winter.

Four laptops were stolen from the St. John's headquarters of the Eastern School District in February.

The computers contained personal information — names, phone numbers, addresses and even medicare program numbers — of about 28,000 students, and were kept in offices in Atlantic Place in downtown St. John's.

In a report released Thursday, the information and privacy commissioner said the school board did not do enough to protect the information of its students.

The board breached the provincial Access to Information and Protection of Privacy Act, Ed Ring said, "by not having reasonable safeguards in place to protect personal information which then resulted in unauthorized disclosure of personal information."

Among other things, Ring found that security provisions on the laptop computers amounted only to passwords.

Ring called for more stringent security measures, involving not only encryption but changes to administrative procedures.

Ring said that the school board office has already improved many of its procedures since the February theft, including technical changes that fall into the guidelines of the privacy act.

Darrin Pike, the director of education with the Eastern School District, said the board has worked with Ring's office to improve its operations.

"We certainly take responsibility for what happened," Pike told CBC News Friday.

"I don't think that the heightened awareness was to the extent that it should have been," he said. "I guess the world, when it comes to data security now, is at a different level than it was a few years ago, and following past practices is not where you need to be in today's standards."

Information on the computers was being used to help plan school bus routes.

Ring said student numbers assigned through MCP, the provincial medicare plan, should not be used to track students. Ring said a better choice is using an alternate system, such as assigning a student number.

The report noted that it still not known how thieves gained access to the board offices in Atlantic Place.