Information ranging from student birth dates to parent employers was released inadvertently by Poway Unified School District (PUSD), angering some parents who are demanding the district establish procedures to prohibit a similar breach of security in the future.
Parents of PUSD students received an email Monday alerting them that the records were released accidentally. In the initial notification, Associate Superintendent Malliga Tholandi said the records handed over under a Public Records Request Act (PRA) included directory information and district-based test scores.
After a special session held Wednesday, the school board instructed administrators to pull together details of what specifically was released.
Officials said Thursday that the files included:
- Names and birthdates, student ID numbers, demographics, directory information, language fluency, hearing and vision screening results of 36,443 students from July 2014.
- Names, employers and occupations of 75,716 parents from January 2015
- GATE testing results of 1,752 students from March 2014
"Given the scope of data involved, it is likely most, if not all, PUSD students enrolled during this time period and their parents were included," Acting Superintendent Mel Robertson, Ed.D. said in a prepared statement.
Officials added that Social Security numbers, financial data, and Individualized Education Program (IEP) data were not released.
Local
Gabriela Dow, a Poway parent and a member of the district's Education Technology Advisory Committee, wrote the PRA on April 7 asking for "any and all documents, emails, and records containing her name and her childrens’ names,” according to the district.
The request included over 9,500 emails placed on two CDs, the district said. In the process, some unredacted files were inadvertently included.
Dow informed the district about the sensitive material on Monday, May 9, the district said. Three days later, officials asked her to return the CDs to the district.
Dow took the laptop containing the student education records to the San Diego County District Attorney’s Office on May 13.
District officials said the CDs will be destroyed.
"Importantly, this data was not delivered by PUSD to the parent via other electronic means or over the internet and the District did not give it to anyone else,” Robertson said.
At Wednesday's special session of the PUSD board members, Dow said, “One CD, one laptop doesn’t mean the information hasn’t already been shared in multiple places for years."
After PUSD received 84 PRA requests for the 2015-2016 school year, a decision was made to hand the process of reviewing and redacting sensitive information to legal counsel.
Robertson said the process will once again be done by district employees effective Thursday.
He also told parents that the administration would:
- Eliminate any protected student data from requested documents
- Adopt a new policy regarding access to district records
- Provide ongoing training on PRA requests for all personnel
- Examine how student data is stored and shared
- Consider and implement changes that will make our processes more secure
Under a California Public Records Act (CPRA) request, public agencies must provide records on request to anyone who wants to inspect the records during office hours. There are some exceptions to this rule like birth or adoption records or attorney-client discussions.
However, there is also a federal law that protects students’ education records from being released without a parent’s written permission.
The next scheduled PUSD board meeting will be Tuesday, May 31 at 6:00 p.m.
