PowerSchool ‘not off the hook’ for data breach: ex-privacy commissioner

Chantal Bernier says the agreement that ended a federal probe into the hack was the most effective way to hold PowerSchool accountable, but called for more powers at the agency.

A former federal privacy commissioner says PowerSchool is “not off the hook” over the massive data breach that affected millions of kids, teachers and parents despite the end of an investigation into the company’s cybersecurity practices, noting the improvements PowerSchool has committed to making.

Chantal Bernier, who was assistant federal privacy commissioner from 2008 to 2014 and held the role of interim commissioner in 2014, told Global News the agreement announced Tuesday was the most effective way for the Office of the Privacy Commissioner (OPC) to hold PowerSchool accountable, given the deadlines the company now has to boost its security and prove it can prevent future cyberattacks.

“It keeps alive the right for the OPC to initiate a complaint and then go into a full investigation should PowerSchool not come through,” Bernier said in an interview.

“PowerSchool is not off the hook at all.”

The OPC said Tuesday that privacy commissioner Philippe Dufresne had decided to end his investigation into the breach after PowerSchool “took measures to contain the breach, notify affected individuals and organizations and offer credit protection, and has voluntarily committed to additional actions to support its security safeguards.”

According to a letter of commitment with the OPC signed last week, PowerSchool has until the end of July to provide any additional information related to the data breach to the commissioner, and will need to provide evidence by the end of this year that it has strengthened its monitoring and detection tools.

By March 2026, the education software company will also need to get recertified under global information security standards and provide an independent, third-party security assessment and report to the OPC on PowerSchool’s updated safeguards to protect personal information, prevent and respond to potential breaches, and other cybersecurity measures.

Dufresne will have to review and approve PowerSchool’s plans to accept or reject any recommendations from that report, as well as ensure the company meets its other commitments.