NB elementary school mails forms to the wrong homes
Technorati Tag: Security Breach
Date Reported:
9/6/08
Organization:
School District 18 (New Brunswick, Canada)
Contractor/Consultant/Branch:
Alexander Gibson Memorial School
Victims:
Parents and students
Number Affected:
"about 45 parents"*
*The news report does not mention how many students may be affected
Types of Data:
Personal information, including "addresses, phone and medicare numbers"
Breach Description:
"The personal information of about 45 parents was accidently [sic] released by two teachers at Alexander Gibson Memorial School recently."
Reference URL:
Canadaeast News Service
Report Credit:
Jennifer Dunville, Canadaeast News Service
Response:
From the online source cited above:
The personal information of about 45 parents was accidently [sic] released by two teachers at Alexander Gibson Memorial School recently.
Forms including the addresses, phone and medicare numbers of Grade 1 students at the school were sent to the wrong homes.
Teachers were asked to have the parents of their students check the forms for errors, but two instructors misunderstood and assumed the forms were blank.
[Evan] This is a telling statement. It happens all of the time, but I always feel uneasy about confidential information sent in the mail.
"Normally, we have blank forms requesting information from parents to keep on file, such as emergency contact numbers," says Alex Dingwall, superintendent of School District 18, which administers schools in the Fredericton area.
"This year, instead of asking parents to fill out the forms again, we used the same ones they filled out last year, which means they weren't blank."
[Evan] I presume that this decision was based on convenience. I don't think that it was necessarily a wise decision. Often times decisions made to increase convenience also increase (security) risk.
"Knowing your personal information went out to someone else would be quite disconcerting," Dingwall says. "We haven't had any incidents or complaints related to this, but we are certainly very sorry it occurred."
The superintendent says Gibson School staff have send out letters explaining and apologizing for the mistake.
He says schools are normally protective of the personal information of students and their families, but mistakes can happen.
[Evan] Mistakes do happen. The chances for mistakes increase when process changes are not properly communicated or followed. Mistakes are also more common in environments where proper training is not provided.
"It was just a mistake on the part of a couple teachers and the school is having the formed reprinted now," Dingwall says. "Parents who received someone else's information are being asked to disregard it."
[Evan] I don't agree. I don't think that the mistake is solely "on the part of a couple of teachers". I think the mistake can likely be attributed to a combination of factors.
Commentary:
I am sure that the two teachers involved in this incident feel terrible about it. It doesn’t help when they are publicly pointed out as being responsible. The school district officials made the decision to change the process and send pre-filled out forms and then relied on teachers to conduct the mailing. If there was only one teacher involved, I would be more inclined to believe that it was just one teacher's mistake. The fact that there are two teachers involved leads me to believe that the process change was either not well communicated and/or not well understood (poor training & awareness).
The risk to the parents and students is probably small. The number of people affected and expanse of the exposure are both limited. My points are based on principle more than anything else, I suppose.
Past Breaches:
Unknown
Date Reported:9/6/08
Organization:
School District 18 (New Brunswick, Canada)
Contractor/Consultant/Branch:
Alexander Gibson Memorial School
Victims:
Parents and students
Number Affected:
"about 45 parents"*
*The news report does not mention how many students may be affected
Types of Data:
Personal information, including "addresses, phone and medicare numbers"
Breach Description:
"The personal information of about 45 parents was accidently [sic] released by two teachers at Alexander Gibson Memorial School recently."
Reference URL:
Canadaeast News Service
Report Credit:
Jennifer Dunville, Canadaeast News Service
Response:
From the online source cited above:
The personal information of about 45 parents was accidently [sic] released by two teachers at Alexander Gibson Memorial School recently.
Forms including the addresses, phone and medicare numbers of Grade 1 students at the school were sent to the wrong homes.
Teachers were asked to have the parents of their students check the forms for errors, but two instructors misunderstood and assumed the forms were blank.
[Evan] This is a telling statement. It happens all of the time, but I always feel uneasy about confidential information sent in the mail.
"Normally, we have blank forms requesting information from parents to keep on file, such as emergency contact numbers," says Alex Dingwall, superintendent of School District 18, which administers schools in the Fredericton area.
"This year, instead of asking parents to fill out the forms again, we used the same ones they filled out last year, which means they weren't blank."
[Evan] I presume that this decision was based on convenience. I don't think that it was necessarily a wise decision. Often times decisions made to increase convenience also increase (security) risk.
"Knowing your personal information went out to someone else would be quite disconcerting," Dingwall says. "We haven't had any incidents or complaints related to this, but we are certainly very sorry it occurred."
The superintendent says Gibson School staff have send out letters explaining and apologizing for the mistake.
He says schools are normally protective of the personal information of students and their families, but mistakes can happen.
[Evan] Mistakes do happen. The chances for mistakes increase when process changes are not properly communicated or followed. Mistakes are also more common in environments where proper training is not provided.
"It was just a mistake on the part of a couple teachers and the school is having the formed reprinted now," Dingwall says. "Parents who received someone else's information are being asked to disregard it."
[Evan] I don't agree. I don't think that the mistake is solely "on the part of a couple of teachers". I think the mistake can likely be attributed to a combination of factors.
Commentary:
I am sure that the two teachers involved in this incident feel terrible about it. It doesn’t help when they are publicly pointed out as being responsible. The school district officials made the decision to change the process and send pre-filled out forms and then relied on teachers to conduct the mailing. If there was only one teacher involved, I would be more inclined to believe that it was just one teacher's mistake. The fact that there are two teachers involved leads me to believe that the process change was either not well communicated and/or not well understood (poor training & awareness).
The risk to the parents and students is probably small. The number of people affected and expanse of the exposure are both limited. My points are based on principle more than anything else, I suppose.
Past Breaches:
Unknown
Posts Atom 1.0
Comments