Confidential student information released in District 203 data leak Central Times
pYour donation will support the student journalists of the Central Times by helping to fund their monthly print issuesppCentral Times NCHS centraltimes Instagram photos and videosppConfidential student information was unintentionally leaked in Naperville Centrals School Improvement Plan which was released publicly on Friday Sept 20 It was removed on Tuesday Sept 24 around 335 pm when Central Times staff brought the breach to the attention of Principal Jackie ThorntonppThe leak included student grades for both first and second semester of the 202324 school year across two documents as well as additional protected data points on IEP and 504 status eligibility for free and reduced lunch dual language status and limited English proficiency status Students full names and ID numbers were also includedppThat isnt consistent with the quality of the work we do at Naperville Central and our apology is sincere as is our promise that it wont happen again Thornton saidppThe leak was limited to only Central Times staff reporting on the incident according to District 203s IT department Though the School Improvement Plan is publicly available through BoardDocs only emails with a District 203 domain including students and faculty were able to access the sensitive datappUpon notification we directed all involved students to delete any copies of the data and emphasized the serious ramifications of sharing this information America Villalobos communications specialist for District 203 wrote in a statement to the Central Times Our technology team conducted a thorough review and we have strengthened our data privacy measures by auditing documentation permissions in compliance with all state and federal regulations as well as Board of Education Policy 7340 on student records Additionally these procedures were reiterated with staff on Wednesday Sept 25pp
None of us want this to happen again none of us wanted this to happen in the first place
Principal Jackie Thornton
snopullquote674dc9a111b54
display flex
float left
margin 30px 30px 30px 0
width 50
bordercolor 888888
bordertopwidth 5px
borderrightwidth 5px
borderbottomwidth 5px
borderleftwidth 5px
backgroundcolor dddddd
snopullquote674dc9a111b54 ppullquotetext
snopullquote674dc9a111b54 pquotespeaker
color 000000 important
snopullquote674dc9a111b54 pullquotepic
width 100
marginleft 0px
snostorybody snopullquote674dc9a111b54 ppullquotetext
fontsize 22px
lineheight 14em
snopullquote674dc9a111b54 quotebar
background dddddd
flex 0 0 90px
margintop 15px
marginleft 15px
paddingleft 15px
paddingtop 15px
marginright 15px
snopullquote674dc9a111b54 largequote
color 888888
snostorybodycontent snopullquote674dc9a111b54 ppullquotetext snoslideshowsegment snopullquote674dc9a111b54 ppullquotetext
textindent 0px
paddingtop 0px
snopullquote674dc9a111b54 quotebody
width unset
snopullquote674dc9a111b54 quotebody
maxwidth calc100 105px
ppNone of us want this to happen again none of us wanted this to happen in the first placepp Principal Jackie ThorntonppThe data included all 2433 students at Central during the 202324 school year from current sophomores in the Class of 2027 to graduated seniors from the Class of 2024 There were more than 31000 lines of sensitive data across the two documentsppNone of us want this to happen again none of us wanted this to happen in the first place Thornton said We were very righton with regard to how are we going to minimize the exposure and how are we going to rectify thatppAccording to legal experts the publication of such information was in violation of the Family Educational Rights and Privacy Act of 1974 the Individuals with Disabilities Education Act the National School Lunch Act and the Illinois School Student Records ActppUnder FERPA schools are not allowed to disclose personally identifiable education recordsincluding grades classes taken and special education recordsunless they obtain prior written consent from the student or their parentsppThe information that appears to have been released would be protected under FERPA and so the release of that information in a general sense would violate FERPA government transparency lawyer Matt Topic said Unless that was part of a policy or practice as opposed to just a mistake or an act of negligence its unlikely the Department of Education would cut any of the districts funding Its possible that if they were asked to look at this they would remind the school district of the importance of keeping this information confidentialppThe Department of Education declined to comment on the specifics of District 203s data leakppIf we were to receive a complaint from a parent or eligible student alleging that his or her rights under FERPA were violated when a school official improperly disclosed information from their childs or their education records we would work with the school to achieve their voluntary compliance with FERPAs requirements a Department of Education spokesperson told the Central Times We recommend that parents discuss any concerns that they have about such matters with their school administrationppAlthough FERPA requires a policy or practice of student privacy violations to be enforced the Illinois School Student Records Act prohibits any release transfer disclosure or dissemination of school student records or information contained thereinppThe Illinois School Student Records Act prohibits the release of school student recordswhich is most information concerning a studentand the kinds of information that seems to have been released would qualify as protected information under that statute Topic said Based on what Ive seen it would appear to be a violationppThe leak also included the names and other personally identifiable information of all students who had 504 plans and IEPs That information is confidential and protected under both IDEA and FERPAppAs a member of the public I should not be able to tell whether a certain student by name is enrolled for special education supports and services Jonathan GastonFalk a staff attorney for the Student Press Law Center wrote in a statement to the Central Times The district was out of compliance not only with FERPA but IDEA as wellppThe National School Lunch Act prohibits schools from disclosing any information about student eligibility for free and reduced lunches except to a limited number of government officials Those records are also protected under FERPAppMore than a dozen administrators reviewed the School Improvement Plan ahead of its presentation at the Board of Education meeting on Monday Sept 23ppWe want to reaffirm our commitment to transparency and privacy following the recent incident involving the inadvertent exposure of sensitive student information linked to Naperville Centrals school improvement plan Villalobos wrote We take data security very seriously and sincerely apologize for this breach As always we are dedicated to regaining the communitys trust and ensuring that such incidents do not occur in the futureppSince the incident Central has changed its practices on student data collection A statement released by Thornton on Wednesday Sept 25 at 1016 am encouraged teachers to double check and ensure that your data files are also restricted to the small group of people that truly need that informationppWell never share a document in the same way again Thornton said I know that I personally am not using the Naperville general domain anymore for any document that I am creating or sharing not even those that dont include sensitive information I reminded and will continue to remind our staff that its sometimes easyespecially when youre in the work process and theres a team of people that are working on the shared documentto use that instead of entering everybodys names but whenever there is sensitive information we need to take the step to protect itppEditors note this story has been updated with a statement from the US Department of Education that was received after its original publicationppYour donation will support the student journalists of the Central Times by helping to fund publication expendituresppNaperville Central High Schools awardwinning newspaperpp Cancel replyppYour email address will not be published Required fields are marked ppComment ppName ppEmail pp
ppppΔdocumentgetElementById akjs1 setAttribute value new Date getTime p
None of us want this to happen again none of us wanted this to happen in the first place
Principal Jackie Thornton
snopullquote674dc9a111b54
display flex
float left
margin 30px 30px 30px 0
width 50
bordercolor 888888
bordertopwidth 5px
borderrightwidth 5px
borderbottomwidth 5px
borderleftwidth 5px
backgroundcolor dddddd
snopullquote674dc9a111b54 ppullquotetext
snopullquote674dc9a111b54 pquotespeaker
color 000000 important
snopullquote674dc9a111b54 pullquotepic
width 100
marginleft 0px
snostorybody snopullquote674dc9a111b54 ppullquotetext
fontsize 22px
lineheight 14em
snopullquote674dc9a111b54 quotebar
background dddddd
flex 0 0 90px
margintop 15px
marginleft 15px
paddingleft 15px
paddingtop 15px
marginright 15px
snopullquote674dc9a111b54 largequote
color 888888
snostorybodycontent snopullquote674dc9a111b54 ppullquotetext snoslideshowsegment snopullquote674dc9a111b54 ppullquotetext
textindent 0px
paddingtop 0px
snopullquote674dc9a111b54 quotebody
width unset
snopullquote674dc9a111b54 quotebody
maxwidth calc100 105px
ppNone of us want this to happen again none of us wanted this to happen in the first placepp Principal Jackie ThorntonppThe data included all 2433 students at Central during the 202324 school year from current sophomores in the Class of 2027 to graduated seniors from the Class of 2024 There were more than 31000 lines of sensitive data across the two documentsppNone of us want this to happen again none of us wanted this to happen in the first place Thornton said We were very righton with regard to how are we going to minimize the exposure and how are we going to rectify thatppAccording to legal experts the publication of such information was in violation of the Family Educational Rights and Privacy Act of 1974 the Individuals with Disabilities Education Act the National School Lunch Act and the Illinois School Student Records ActppUnder FERPA schools are not allowed to disclose personally identifiable education recordsincluding grades classes taken and special education recordsunless they obtain prior written consent from the student or their parentsppThe information that appears to have been released would be protected under FERPA and so the release of that information in a general sense would violate FERPA government transparency lawyer Matt Topic said Unless that was part of a policy or practice as opposed to just a mistake or an act of negligence its unlikely the Department of Education would cut any of the districts funding Its possible that if they were asked to look at this they would remind the school district of the importance of keeping this information confidentialppThe Department of Education declined to comment on the specifics of District 203s data leakppIf we were to receive a complaint from a parent or eligible student alleging that his or her rights under FERPA were violated when a school official improperly disclosed information from their childs or their education records we would work with the school to achieve their voluntary compliance with FERPAs requirements a Department of Education spokesperson told the Central Times We recommend that parents discuss any concerns that they have about such matters with their school administrationppAlthough FERPA requires a policy or practice of student privacy violations to be enforced the Illinois School Student Records Act prohibits any release transfer disclosure or dissemination of school student records or information contained thereinppThe Illinois School Student Records Act prohibits the release of school student recordswhich is most information concerning a studentand the kinds of information that seems to have been released would qualify as protected information under that statute Topic said Based on what Ive seen it would appear to be a violationppThe leak also included the names and other personally identifiable information of all students who had 504 plans and IEPs That information is confidential and protected under both IDEA and FERPAppAs a member of the public I should not be able to tell whether a certain student by name is enrolled for special education supports and services Jonathan GastonFalk a staff attorney for the Student Press Law Center wrote in a statement to the Central Times The district was out of compliance not only with FERPA but IDEA as wellppThe National School Lunch Act prohibits schools from disclosing any information about student eligibility for free and reduced lunches except to a limited number of government officials Those records are also protected under FERPAppMore than a dozen administrators reviewed the School Improvement Plan ahead of its presentation at the Board of Education meeting on Monday Sept 23ppWe want to reaffirm our commitment to transparency and privacy following the recent incident involving the inadvertent exposure of sensitive student information linked to Naperville Centrals school improvement plan Villalobos wrote We take data security very seriously and sincerely apologize for this breach As always we are dedicated to regaining the communitys trust and ensuring that such incidents do not occur in the futureppSince the incident Central has changed its practices on student data collection A statement released by Thornton on Wednesday Sept 25 at 1016 am encouraged teachers to double check and ensure that your data files are also restricted to the small group of people that truly need that informationppWell never share a document in the same way again Thornton said I know that I personally am not using the Naperville general domain anymore for any document that I am creating or sharing not even those that dont include sensitive information I reminded and will continue to remind our staff that its sometimes easyespecially when youre in the work process and theres a team of people that are working on the shared documentto use that instead of entering everybodys names but whenever there is sensitive information we need to take the step to protect itppEditors note this story has been updated with a statement from the US Department of Education that was received after its original publicationppYour donation will support the student journalists of the Central Times by helping to fund publication expendituresppNaperville Central High Schools awardwinning newspaperpp Cancel replyppYour email address will not be published Required fields are marked ppComment ppName ppEmail pp
ppppΔdocumentgetElementById akjs1 setAttribute value new Date getTime p
