Nova Scotia government dealing with another privacy breach
Medical details, names and contact information inadvertently leaked as people registered for school program
The Nova Scotia government has advised more than 3,000 people that their personal information may have been shared without their knowledge Monday during a 37-minute scramble to get their children registered for a popular school program.
Officials with the Halifax Regional Centre for Education (HRCE), formerly the Halifax Regional School Board, shut down the Excel online registration system after they were told by people using it that they could see the personal information of others on the forms they were supposed to fill out.
Doug Hadley, HRCE spokesperson, said people logging on to register their children flagged the problem almost immediately.
"We started receiving some phone calls to our front desk. Some of our IT staff received some emails and we also started to see people tweet about it all at virtually the same time," he said.
"They could see some personal information about another child such as their name, their date of birth. We also had at least one person tell us that they saw some health-care information about another child."
We have shut down our Excel registration due privacy breach. The issue has been contained. We are currently investigating. Will share more info as it becomes known
—@HRSB_OfficialThat happened to NDP MLA Claudia Chender, who was trying to register her three children for the after-school Excel program at the Dartmouth school they attend.
"When I got to the part where it was authorizing other people to pick up my children, suddenly there was a list of, like, 10 people and their phone number and their age and all of these things," she said.
Chender said the system froze at that point. When she reloaded the page, those forms were empty.
It was only after she completed the process that the opposition politician realized what had happened constituted a privacy breach.
The people responsible for the system are now trying to determine what went wrong.
Hadley said families have been able to register online for close to 10 years.
"But with any type of database system there are constantly upgrades, whether it's to software, to securities. So right now we're trying to see if one of those upgrades may have inadvertently caused this breach to occur," he said.
Roughly 700 people have been notified that their personal information was accessed by someone not authorized to have it. Nova Scotia's Office of the Information and Privacy Commissioner is investigating the breach.
Chender said she's "hoping to get some answers again about why, again, we have an unsecured, public-facing information system that's so easily accessed."
"I mean, I'm not a hacker. I literally did everything I was instructed to do and was given access on my screen in an unavoidable way to other people's private information."
HRCE apologizes
According to a statement posted on the HRCE website, "approximately 3,200 parents/guardians would have received an access code to register this morning. Of those with access, 1091 completed their registration form, and 82 had started but did not finish."
Those who logged on received an email apology from Joanne Williams, the co-ordinator of the EXCEL program.
"We deeply regret that this privacy breach has occurred and please know that we are taking this matter seriously."
The province's information and privacy commissioner is monitoring the actions taken by the province but hasn't decided yet whether this latest breach warrants an investigation.