Alberta Privacy Commissioner Demands Urgent Cybersecurity Fixes

UPDATE: Alberta’s privacy commissioner, Diane McLeod, is urgently calling for enhanced cybersecurity measures in schools following a significant data breach that exposed sensitive information of over 700,000 students. The breach, linked to the education software provider PowerSchool, occurred in December 2024 and has raised alarms about the safety of student data across the province.

The recent report indicates that 33 public, charter, and Francophone schools reported being affected by this breach, leading to the potential compromise of personal details such as names, birthdates, addresses, social security numbers, academic records, and even medical information. McLeod emphasized the urgent need for school authorities to bolster their security protocols to prevent such incidents from recurring.

“Unfortunately, it is the fault of the schools at the end of the day. But ultimately, it was the vendor who dropped the ball,” stated McLeod, highlighting the dual responsibility of educational institutions and software providers in safeguarding sensitive data.

In January, parents were notified about the breach, which affected not only students but also parents and school staff. Prominent school authorities impacted include the Calgary Board of Education and several public school divisions in Red Deer, Medicine Hat, and Fort McMurray.

The report reveals that most schools failed to include adequate privacy provisions in their contracts with PowerSchool, violating provincial privacy regulations. Moreover, many lacked effective policies to monitor PowerSchool’s security measures, putting students’ information at greater risk.

In a related development, a federal privacy investigation into the PowerSchool breach was recently discontinued after officials expressed satisfaction with the company’s commitment to strengthen its security measures. PowerSchool acknowledged that unauthorized access was gained through stolen credentials used by a contractor, which allowed for extensive breaches of student information systems.

“This is the tip of the iceberg,” warned McLeod, as she addressed the growing use of educational technology without sufficient oversight. The report suggests that the province should provide guidance and resources to help school boards develop better privacy policies and monitoring practices.

Education Minister Demetrios Nicolaides stated on Tuesday that the province is committed to enhancing procurement processes for education technology and will provide essential guidance to school boards on vendor contracts. School boards are urged to implement reporting requirements that compel vendors to regularly disclose their compliance with privacy obligations.

The report’s recommendations for PowerSchool include implementing multi-factor authentication, enforcing strong password policies, and ensuring timely deletion of personal information after contract termination.

As the new school year begins, the urgency of addressing cybersecurity risks in educational settings has never been clearer. Parents and educators alike are encouraged to remain vigilant about data privacy and to advocate for stronger protective measures within their schools.

McLeod’s office is reaching out to international firms like PowerSchool to collaborate on developing educational technologies that prioritize student privacy. The Calgary Board of Education has committed to reviewing the report’s recommendations to enhance its cybersecurity processes.

The implications of this breach extend beyond Alberta, affecting families and institutions throughout Canada and the U.S. As experts urge schools to adopt robust cybersecurity strategies, parents are left to wonder how to protect their children’s personal information amidst growing digital threats.