Sydney high school accidentally emails out students’ confidential health and welfare information
A Sydney high school has accidentally emailed confidential information on students’ health conditions and welfare to staff, students and parents.
A staff member at the Blackwattle Bay campus of Sydney Secondary College sent the email on Friday, intending to include a weekly newsletter, but instead attached a pdf titled“Welfare Watch”, marked as confidential, which contained personal and private information on about 30 year 11 students.
The subject line of the email and the pdf was correctly titled “Term 1 Week 5a” for the school’s weekly newsletter called Buzz on the Bay. But once recipients clicked into the document the heading read “Welfare Watch”.
Sign up for Guardian Australia’s free morning and afternoon email newsletters for your daily news roundup
After the email was sent, steps were reportedly taken to have it removed from accounts where possible.
“The school is deeply apologetic for the breach and understands it is completely at odds with the high importance it gives to respecting and safeguarding the private information of its students and their families,” the NSW education department said on behalf of the school.
A workplace practices investigation is under way, led by the department, with assistance from its cybersecurity team.
The school has apologised individually to families for the breach of privacy and was in the process of speaking to every student affected, the department said.
The school’s principal, Leiza Lewis, wrote to all parents to apologise soon after the initial email was sent, and said a work practices investigation and disciplinary inquiry were under way, the department confirmed.
“The message mistakenly sent … contained personal, private information about a group of students at our school – it should be deleted immediately, and not copied or forwarded,” Lewis wrote.
“A work practices investigation into how this mistake was made is being conducted and the behaviour of the staff member will be subject of a discip
linary enquiry,” the letter said.
The chair of the Blackwattle Bay campus P&C, Jocelyn Prasad, said the incident was “a very unfortunate case of human error” and the P&C looked forward to considering the findings of the investigation.
“Our experience is that the school is run by deeply committed and passionate teachers who put the interests of students first and foremost, often with limited resources. Rather than target individuals, we hope the investigation creates robust systems in all schools so breaches like this don’t happen again,” she said.
Prasad said the P&C was available to support parents and students who wanted to contact them, but had not sought contact details of those affected for privacy reasons.
Blackwattle Bay campus, in Glebe, is the year 11 and 12 component of Sydney Secondary College, which also comprises 7-10 campuses at Balmain and Leichhardt.
NSW government schools act in accordance with the Privacy and Personal Information Protection Act 1998, and the Health Records and Information Privacy Act 2002 – laws intended to minimise the risk of any misuse of personal and health information and to protect privacy.