Poway Unified School District releases statement following data breach
POWAY (KUSI) — The Poway Unified School District announced the development of a new process to prevent any further data breaches. The accidental-release of records of thousands of students has prompted immediate action.
"The District will handle and process all PRAs internally effective May 18th, 2016 and will eliminate any protected student data from the documents being requested," the District announced in the statement. "The District will adopt a new policy regarding access to District records as soon as possible. Additionally, the District will ensure ongoing training is provided for all personnel involved in PRA requests."
The incident stems from a data breach following a parent’s request for any and all information the District had that contained her name and her childrens’ names. Any member of the public has a right to request public records from a public agency through the California Public Records Act.
The inquiring parent received two compact disks that were intended to include only the information she had requested. She had possession of the information for approximately one week, informing the Board of Education she had accidentally been given a mass amount of sensitive data. The parent returned the CD’s to the District, as well as handing over her laptop for further investigation. The information was not transmitted electronically, isolated to the CD’s.
Related Link: Poway Unified hears parents’ concerns over data breach
Poway Unified School District directly identified what information was accidentally release in the statement:
A July 2014 document including 36,443 students’ names and birthdates, student ID numbers, demographics, directory information, language fluency, hearing and vision screening results. This information is used by staff in the normal operations of school districts. Social Security numbers, financial data, and Individualized Education Program (IEP) data were not released. A January 2015 document containing 75,716 parents’ names, employers, and occupations. Given the scope of data involved, it is likely most, if not all, PUSD students enrolled during this time period and their parents were included.
Poway Unified School District concluded, based on the information gathered, that "there is no danger or threat to our students’ and families’ safety or identities."