32 students experienced privacy breaches due to tech company error: Sask. comissioner

Saskatchewan's information and privacy commissioner has released his findings on an incident where trans students were "outed" to their classmates because of an data error that affected numerous Saskatchewan school divisions in August.

That month a Saskatoon parent told CBC News she had discovered that her transgender son was deadnamed on online education portal Edsby. Deadnaming is when a transgender person is called by their birth or legal name, rather than the name they identify by.

In his December report, commissioner Ronald J. Kruzeniski said he found that 32 students in total were affected. He said the birth names were publicly available for about 14 days and could have revealed that the students were transgender.

"The school divisions did not have consent of the 32 students to disclose their personal information," Kruzeniski said. "Therefore, I find a privacy breach occurred for each student whose birth name was made available."

He also found that the school divisions have not adequately indicated to his office all the steps taken to prevent further breaches of this kind.

The breaches came from technology company Edsby — an online portal meant to help teachers, parents and students communicate. Students can use it before the school year begins to take a look at their timetables and see whether they have any classes with friends.

According to Edsby, between Aug. 10 and Aug. 24, 2023, a technical glitch in the system resulting in the display of students' legal names instead of their preferred names on the Edsby online portal in several Saskatchewan school divisions. The company apologized for the error in August.

Edsby said its Saskatchewan school division clients were Saskatoon Public Schools, Regina Public Schools, Regina Catholic School Division, Prairie Spirit, Good Spirit, North East, Lloydminster Public School Division and Light of Christ.

Edsby's investigation later revealed that Lloydminster Public and Regina Public Schools were not impacted by the "glitch" because their systems were not syncing with Edsby's system at the time of the breach.

The privacy commissioner said students' legal names displayed in Light of Christ and Prairie Spirit divisions were lengthened versions of their preferred name.

Meanwhile, no North East division student was impacted, as they did not have access to class rosters until Sept. 1. 

Kruzeniski said he found that the school divisions impacted by the breaches and Edsby itself "made reasonable efforts to contain the breaches of privacy by disabling the Edsby platform while the issue was being resolved" on Aug. 24.

He said the school divisions reported that all students affected by the breaches were notified about it by Sept. 27 through their school counsellors.

Kruzeniski said school divisions told his office that Edsby took "technical steps" to ensure this kind of incident doesn't happen again.