Personal information accidentally made public

The agency that co-ordinates school busing for schools in the Peterborough area has issued an apology after it accidentally allowed public access to a database of student contact and busing information through social media.

Student Transportation Services of Central Ontario revealed Tuesday that the personal information of students, including addresses and dates of birth, was breached after a posting was made to the agency’s Facebook and Twitter accounts last Wednesday.

The agency had posted an update about contract negotiations for bus operators in Clarington but inadvertently posted an internal staff training document that contained a link that allowed access to student contact and busing information.

Once the breach was pointed out, apparently a couple hours later, the postings and the document were removed from the social media sites, the agency says, and access to the database was also closed.

But some files in the database had already been accessed through the link.

Time-stamped logs were able to identify which children’s files were accessed. The families of those affected were notified.

“We were able to identify a small number of files where private information (e.g. date of birth, address and busing information) was accessed,” the apology from STSCO states.

“We have notified the affected individuals and apologized for the mistake.”

The agency plans to adopt new measures to prevent such a breach of personal information from happening again.

“We want to assure our families that we took immediate action to correct this issue, and have put measures in place to prevent it from happening again,” the apology from STSCO states.

“Again, we sincerely apologize for this error.”

Some outraged parents took to social media themselves to express their outrage about the accidental breach of privacy.

“I find this very alarming that anyone who clicked that link was able to access any child’s information, from bus stop pick up time, to location, to home address and school as well as contact information,” Theresa Perry stated.

“This is not okay. In this day (and) age there could be people waiting at stops, outside our houses and/or school .... there’s no way you can tell who accessed this information as you didn’t even know you’d leaked the information to begin with. Shame on you for thinking an apology fixes this.

“This apology is not enough as it is not entirely truthful,” LeighAnne Orser added. “The link led to an area that should have required a password to enter. Why is the system set up like that in the first place? The system was obviously not a secure one prior to this link being posted.”

“Why does a staff training document have a link that provides access to students contact and busing information?” Jean Laite stated. “Should this information not be password protected? Why is it accessed through a training document?”

STSCO co-ordinates busing for elementary and high school students with both the Kawartha Pine Ridge District School Board and the Peterborough Victoria Northumberland and Clarington Catholic District School Board in Peterborough city and county, Northumberland County, Clarington and the City of Kawartha Lakes.