NEWFOUNDLAND AND LABRADOR
Office of the Information and Privacy Commissioner Launches Investigation Into PowerSchool Breach

On May 30, Commissioner Kerry Hatfield announced that the Office of the Information and Privacy Commissioner would be commencing an investigation into the PowerSchool breach. That breach, which affected PowerSchool customers worldwide, impacted thousands of current and former students and teachers in this Province.

On February 11, 2025, Federal Privacy Commissioner Philippe Dufresne announced that PowerSchool (the company) was the subject of an investigation by his Office under the Personal Information Protection and Electronic Documents Act (PIPEDA), which is a privacy law that covers businesses operating in Canada. Commissioner Hatfield will focus her investigation on the provincial Department of Education's use of PowerSchool, including the Department's decisions and practices about what information it collected using PowerSchool, its policies and practices about how long information of students and teachers was retained in PowerSchool, and other matters relevant to the Department's use of PowerSchool which may have either mitigated or exacerbated the impact of the breach.

Commissioner Hatfield commented:

"This breach involved MCP numbers, social insurance numbers, health details, and other sensitive information about current and former students and teachers in this Province going back a number of years. Before launching this investigation I felt it was appropriate to give the Department sufficient time to assess the impact of the breach, notify those who were impacted, and take steps to adjust its policies and practices. It has now had ample opportunity to do so."

"We have been in communication with the Department since receiving notification of the breach and we understand that the Department has already taken a number of positive steps. The purpose of my investigation is not only to assess whether the Department has responded adequately to the breach, but also to ensure that measures taken by the Department to prevent future occurrences of this nature are sufficient. People have a right to expect that when a public body collects their sensitive personal information that it will do so in accordance with the law. That means that a public body shouldn't collect more personal information than necessary, that it will take reasonable steps to protect the information it holds, and that it will retain that information for only as long as needed and then securely destroy it."