School district investigating data release on 'most' of its 18,000 students
COTTAGE GROVE, Minn. — South Washington County Schools apologized and launched an investigation Thursday, Aug. 17 after personal and transportation data on most of the district's 18,000-plus students was mistakenly emailed to parents.
District administrators were starting to investigate the data release amid concerns about student safety and legal implications that could stem from the public release of private education data.
The private data was contained in emails sent to parents Wednesday outlining student transportation for the upcoming school year. Parents received an email that either contained data on 9,000 families or another file on over 9,600 other families. Some parents with multiple students in the district received both data files in separate emails.
"On behalf of the district, I apologize for this error," Superintendent Keith Jacobus said.
The files contain student names, home addresses and schools; parent names, phone numbers and email addresses; and student busing information, including pick-up and drop-off time and location and the bus route and description.
The emails were from the Transportation Department, but the district uses a mass notification service called Blackboard Connect to communicate with parents. Jacobus said the investigation will look at how the files were attached to the emails
"We know it was not done intentionally or maliciously, and that it was a mistake or employee error," he said in an interview.
Jacobus said the investigation also will look at why access to the files was not disabled earlier. The district could not immediately disable the files because the emails were sent through the Blackboard Connect service. The files could be viewed Thursday morning without any special access. Eventually both were deactivated.
"I'm not sure why that took so long," Jacobus said.
Communications Director Barb Brown said the district learned of the release within about 15 minutes of the emails being sent, but it took time to work through.
"There's just a lot of things that you need to consider, and we don't want to make another misstep" by releasing inaccurate information to the public, she said.
Legal implications added to the district's desire for caution, Brown added.
The district issued its first statement about the release about three hours after the emails were sent, as parents were starting to vent on Facebook and elsewhere.
"People with protective orders with kids in the district just got exposed," one woman wrote in a Facebook group.
"Wow. Yes, I got it too. Unbelievable," added another.
Joseph Hernandez of Woodbury has three kids in the district — two at Red Rock Elementary, one at Lake Middle School — and he received an attachment in each student's transportation information email. It's a safety concern, he said.
"The concern is that it's almost like a perfect list of every student if you're looking for them, with all their contact information," Hernandez said in an interview. "I guess they assume everyone in the district is a nice person, and that can't be true."
Hernandez said there also are identity theft concerns. He said this also raises questions about the district's data policy.
"It shows just a lack of maybe knowledge or care about data," he said.
Jacobus said the district has been in consultation with its attorney.
Student safety is the district's No. 1 concern, Jacobus said. Administrators will explore whether to change bus routes.
"We're going to look at anything that's feasible to do," he said.
The district will prepare a report when its investigation is complete, and parents will be able to request a copy of the report.
Jacobus asked that parents delete the attachment and not forward it to others.