An investigative report shows that the Ministry of Education failed to provide enough security to prevent the unauthorized access of a hard drive that had personal information on it.
Back in September, 2015 a hard drive full of information about 3.4 million B.C. and Yukon students and B.C. teachers was lost. In 2011 the information was transferred onto two portable hard drives. One was used by Ministry staff and the other was supposed to be stored offsite as a backup.
The government notified the Office of the Information and Privacy Commissioner (OIPC) that the hard drive had gone missing on September 18th. The hard drive mostly had information about names, genders, dates of birth, and personal education numbers on it. There was however other information that talked about students who were cancer survivors, children in care, special needs children, and students that were receiving financial assistance.
Immediately after the item was stolen an investigation started. The report was finally released on Thursday and it found that the Ministry did not do enough to protect the hard drive from getting lost.
The transfer from a desktop computer to a hard drive went against corporate policy. The Ministry should have encrypted the information on the hard drive, which security policies require, but they did not.
The Ministry also failed to place the backup hard drive at a government approved records facility.
The report had a number of recommendations including:
When the Ministry noticed that the hard drive was missing they considered directly notifying 2.75 million individuals, but they did not have reliable address information or any information on file. Instead a news release describing the types of information that was on the hard drive was released.
