Privacy breaches by Victorian Education Department

April 11, 2017 |

While government agencies are more systematic in their approach to document management and privacy that doesn’t mean they are particularly good at it.  They are better than many private sector organisations but that is not a ringing endorsement by any means.

In Confidential student details published in Education Department blunder the Age reports on an extraordinary privacy breach where personal information of students who have self harmed and been the subject of bullying or their medical conditions were published on the Victorian Education Department website.  In some of those cases the personal information was accompanied by the personal information of the parents including home addresses and mobile numbers.  It is quite an extraordinary breach and likely caused by incompetence within the Department rather than a hack.  The article provides:

In a major privacy breach, the Victorian Education Department has published confidential information which identifies children who have self-harmed, bullying victims and students’ medical conditions.

Up to 115 families have been affected by the blunder, which occurred when hundreds of submissions were uploaded to the department’s website on Friday without personal details being redacted.

This included parents’ names and, in a few instances, their home addresses and mobile numbers.

The submissions, which were in response to proposed new regulations for Victorian schools, detailed how home-schooling families had pulled their children out of school because they were tormented by other students, had mental health issues and received inadequate support for disabilities.

Education Minister James Merlino? has ordered an independent inquiry into the incident, and said he was “deeply concerned”.

The new regulations have been heavily criticised by the home-schooling community, which inundated the department with submissions and requested anonymity when they were made public. 

Victoria’s Commissioner for Privacy and Data Protection, David Watts, requested an urgent briefing from Education Department on Tuesday and urged affected parents to contact him.

The department removed all submissions on Saturday night and said the inquiry would determine what went wrong and recommend steps to prevent it from happening again.

“The department is deeply sorry for disclosing personal information over the weekend, and took immediate action to take the submissions down as soon as the breach was discovered,” a spokesman said.

“We understand the seriousness of this incident, and we are contacting those affected to apologise directly.”

One parent, whose name was unintentionally published online, spoke of how she took her child out of school due to relentless bullying, including an incident where her daughter was held under water by her tormentors during a swimming class.

Another parent, whose identity was also revealed, said they had decided to home-school their dyslexic child because they were self-harming. “He was unsuited to mainstream schooling, and the anxiety and stress of that environment led to him self-harming,” they wrote.

Concerned families frantically tried to contact the department over the weekend to demand that their personal details be taken down. 

Home Education Network co-ordinator Sue Wight said parents had detailed the traumatic events that had led them to home-schooling. 

“There are tales of children being sexually abused, autistic children who were not being taught – these are the reasons why these children were home educated,” she said.

“People are quite alarmed because they made these submissions thinking their privacy would be protected,” she said. 

She said the proposed regulations, which give the school’s watchdog new powers to investigate whether home-schooling families are providing an adequate education and require parents to submit learning plans, put children at risk. 

“It defers a lot of authority to bureaucrats,” she said. “It makes it more difficult for parents to get children out of school when they need to.”

One mother who has experienced domestic violence said she had a stressful weekend after realising her name and phone number had been published. Her child’s diagnosis of autism was also detailed in the submission.

Another parent discovered her name, address and mobile numbers were published after a fellow home-schooling parent contacted her. She said other families now knew about her children’s mental health issues.

“I was a little bit unsettled,” she said. “I spent the weekend thinking about what the repercussions would be. I had written the submissions with the idea of being invisible; if i had known I would be identified it would have written it differently.”

The opposition’s education spokesman Nick Wakeling described the incident as a “a serious breach of privacy”.

“Daniel Andrews must give a full explanation as to how and why private names and addresses, and even personal medical information, were publicly released online,” he said. 

One Response to “Privacy breaches by Victorian Education Department”

  1. Privacy breaches by Victorian Education Department | Australian Law Blogs

    […] Privacy breaches by Victorian Education Department […]

Leave a Reply

Verified by MonsterInsights