Nova Scotia

Nova Scotia government dealing with another privacy breach

The Nova Scotia government is dealing with another embarrassing personal data leak. This time the information shared erroneously includes medical details, as well as names, addresses and phone numbers.

Medical details, names and contact information inadvertently leaked as people registered for school program

The breach on Monday occurred as residents were trying to register for the Excel program, which provides before- and after-school care for elementary school students. (Mark Bugnask/Associated Press)

The Nova Scotia government has advised more than 3,000 people that their personal information may have been shared without their knowledge Monday during a 37-minute scramble to get their children registered for a popular school program.

Officials with the Halifax Regional Centre for Education (HRCE), formerly the Halifax Regional School Board, shut down the Excel online registration system after they were told by people using it that they could see the personal information of others on the forms they were supposed to fill out.

Doug Hadley, HRCE spokesperson, said people logging on to register their children flagged the problem almost immediately. 

"We started receiving some phone calls to our front desk. Some of our IT staff received some emails and we also started to see people tweet about it all at virtually the same time," he said.

"They could see some personal information about another child such as their name, their date of birth. We also had at least one person tell us that they saw some health-care information about another child."

That happened to NDP MLA Claudia Chender, who was trying to register her three children for the after-school Excel program at the Dartmouth school they attend.

"When I got to the part where it was authorizing other people to pick up my children, suddenly there was a list of, like, 10 people and their phone number and their age and all of these things," she said.

Chender said the system froze at that point. When she reloaded the page, those forms were empty.

It was only after she completed the process that the opposition politician realized what had happened constituted a privacy breach.

Claudia Chender, the NDP MLA for Dartmouth South, was trying to register her children for the program when she saw other people's private information. (CBC)

The people responsible for the system are now trying to determine what went wrong.

Hadley said families have been able to register online for close to 10 years.

"But with any type of database system there are constantly upgrades, whether it's to software, to securities. So right now we're trying to see if one of those upgrades may have inadvertently caused this breach to occur," he said.

Doug Hadley is the spokesperson for the Halifax Regional Centre for Education. (CBC)

The breach follows another one earlier this month, when thousands of pages of documents, including personal information, could have been downloaded from the province's access-to-information portal.

Roughly 700 people have been notified that their personal information was accessed by someone not authorized to have it. Nova Scotia's Office of the Information and Privacy Commissioner is investigating the breach.

Chender said she's "hoping to get some answers again about why, again, we have an unsecured, public-facing information system that's so easily accessed."

"I mean, I'm not a hacker. I literally did everything I was instructed to do and was given access on my screen in an unavoidable way to other people's private information."

HRCE apologizes

According to a statement posted on the HRCE website, "approximately 3,200 parents/guardians would have received an access code to register this morning. Of those with access, 1091 completed their registration form, and 82 had started but did not finish."

Those who logged on received an email apology from Joanne Williams, the co-ordinator of the EXCEL program.

"We deeply regret that this privacy breach has occurred and please know that we are taking this matter seriously."

The province's information and privacy commissioner is monitoring the actions taken by the province but hasn't decided yet whether this latest breach warrants an investigation.