The B.C. government has misplaced an unencrypted backup hard drive containing extensive files and databases on millions of B.C. students from 1986 to 2009.
The loss of the drive affects about 3.4 million people and represents the largest privacy breach in the province’s history, Technology, Innovation and Citizens’ Services Minister Amrik Virk confirmed Tuesday.
The bulk of the records contained names, gender, postal codes, grades and personal education numbers of students, but no social insurance numbers, driver’s licence numbers, personal health numbers or banking information, the government said.
One type of file contains additional information on more than 1.8 million students in school between 1991 to 2009, including whether they had special needs, such as a serious mental illness, a learning disability or a chronic health impairment.
A smaller number of files have sensitive and detailed information on:
• 9,273 children in government care prior to 2006-2007, including details of health and behaviour issues.
• 1,052 cancer survivors who took part in a research study on their education outcomes.
• 825 survey results showing teachers’ retirement plans in 2003.
• 200 students who left school in seven districts, including whether they had family problems as well as substance-abuse or mental-health issues. The Greater Victoria, Alberni and Cowichan Valley school districts were part of the 2008 tracking project.
The hard drive, which also contains information on Yukon students, was one of two created in 2011 to make sure the ministry had access to the records in the event of a natural disaster.
“There’s no doubt that a mistake was made — first in how the hard drive was created and secondly in how it was stored,” Virk said. “The bottom line is that this should not have happened.”
Virk, who was notified of the privacy breach Friday, has ordered chief information officer Bette-Jo Hughes to investigate personal information management by all government ministries. The Ministry of Education will be the focus of the first review.
Virk committed to making the report public. “At this point, we are not aware of any access to or use of the information on the missing hard drive,” he said.
“We do believe that the risk to British Columbians is low, however, out of an abundance of caution, it’s my responsibility to let the public know.”
The Education Ministry said it discovered the breach during an ongoing review of its data-storage practices.
Officials say they learned in late July or early August through “anecdotal” evidence or “corporate memory” that the drive existed and that it was stored at a warehouse in Victoria.
The drive is described as a black Western Digital drive about seven-inches high, 5.5-inches deep and two-inches thick. It contains 437 GB of material in 8,766 folders and 138,830 files.
Staff visited the warehouse in mid-August but were unable to locate the drive in the locked cage where it was thought to be kept.
The ministry then searched its electronic database and confirmed on Aug. 28 that the drive existed and had been stored at the warehouse.
The ministry said it launched two extensive grid searches of the warehouse in which teams of up to 50 people went through every box, searching for the drive.
Once it became clear that the drive had disappeared, the ministry notified the chief information officer Sept. 14.
That office realized the extent of the potential breach Sept. 15 and notified privacy commissioner Elizabeth Denham three days later.
British Columbians can contact Service B.C. to find out if their information is on the missing hard drive and the nature of that information.
The contact centre is open Monday to Friday from 7:30 a.m. to 5 p.m. and can be reached by calling 250-387-6121 in Victoria, 604-660-2421 in Vancouver and 1-800-663-7867 elsewhere in B.C.
