B.C. education data breach: government can't find unencrypted hard drive

The B.C. government is unable to locate an unencrypted backup hard drive that contains about 3.4 million records that can be linked to specific individuals, said Technology Minister Amrik Virk on Tuesday.

The hard drive contains student data from 1986 to 2009, including information on children in care, such as their health and behaviour issues.

While the minister called the breach "low risk," the B.C. information and privacy commissioner, Elizabeth Denham, said it raised "very serious privacy issues," and has launched an investigation.

Vincent Gogolek of the B.C. Freedom of Information and Privacy Association says there is cause for concern because of what's in the data.

"It's hard to think of something more intimate and personal than this type of information." said Gogolek.

"Psychological assessments, describing in-care status, substance abuse, family problems. Even if it's not lost, even if it is sitting behind a filing cabinet, those people are going to be upset and rightly so."

NDP education critic Rob Fleming called it "a shocking day for British Columbians. 

"It's the second largest ministry in government, 3.5 million records,"  said Flemming. "Virtually every British Columbian between the age of 22 and 47 is out there somewhere."

"There's no doubt a mistake was made," said Virk. "First, in how the hard drive was created, and secondly, in how it was stored."

There is no indication of fraud or identity theft as a result of the misplaced drive, said Virk.

Potential for harm, humiliation

The hard drive was created in 2011 as a backup for student records, according to an official with the B.C. education ministry. It also contains information about Yukon students.

It includes personal data such as name, gender, postal code and personal education number but does not include social insurance or health numbers.

For a select group of vulnerable students, the data on the lost hard drive is of a much more sensitive nature.

• Detailed list of what's on the hard drive (.pdf)

The drive contains a 2008 file on 200 students who withdrew from the K-12 system in seven school districts, including:

• Full name and birth date.
• Substance abuse information.
• Mental health issues.
• Psychological assessments.
• Detailed family data.
• In-care status (e.g. foster home, group home).

Virk said the government will be examining the potential risk to individuals, and notifying them.

"The chief information officer will be examining the threats ... in terms of the potential for harm, whether it be humiliation, whether it be data, whether it be personal information," said Virk.

Drive was in a locked warehouse

Virk said he learned last Friday at 12:30 p.m. that the drive had been misplaced, but officials with the education ministry have been trying to track it down since early August.

Electronic records showed the hard drive should be in a locked cage inside a locked warehouse, but when staff went looking for it, they couldn't find it despite comprehensive searches.

Virk said information security has improved since 2011, but calls the breach a signal that more needs to be done.

The province's chief information officer has opened an investigation into the breach.

Virk also said he has ordered a review of how personal information will be handled across core government.

People who may be affected can call a Service B.C. information line open Monday to Friday from 7:30 a.m. to 5:00 p.m. PT at 1-800-663-7867, or 604-660-2421 in Vancouver.

CBC News Investigates

If you have information on this story or fear your private records have been compromised in this breach, email us: investigate@cbc.ca