Home » Resolutions » Resolution 2025-4 PROTECTING STUDENT, PARENT, AND TEACHER PERSONAL DATA
Resolution 2025-4 PROTECTING STUDENT, PARENT, AND TEACHER PERSONAL DATA
Submitted by: Queen Elizabeth Elementary Home and School Association
Resolution Content
WHEREAS on January 7, 2025, a cybersecurity incident involving PowerSchool, the student information system used by Prince Edward Island schools, resulted in unauthorized access to personal data of past and present Island school members, including names, dates of birth, addresses, phone numbers, and other sensitive information, and
WHEREAS the breach exposed highly sensitive records spanning decades, including medical information, custody arrangements, and disciplinary notes, impacting over 70,000 individuals in PEI alone, with similar incidents affecting schools nationwide;
THEREFORE, BE IT RESOLVED that the PEI Home and School Federation calls upon the federal government to:
- Enact comprehensive legislation to strengthen data protection measures for educational institutions and third-party service providers, requiring encryption, multi-factor authentication, and annual cybersecurity audits.
- Establish clear guidelines for the retention and deletion of outdated personal information, ensuring data minimization and prohibiting indefinite storage beyond operational necessity.
- Mandate strict penalties for non-compliance with privacy laws, including fines for failure to implement safeguards or promptly disclose breaches.
BE IT FURTHER RESOLVED that the PEI Home and School Federation urges the provincial government to:
- Conduct a thorough review of all third-party educational technology providers, requiring proof of compliance with federal privacy standards (e.g., PIPEDA) before contract renewal.
- Implement mandatory cybersecurity training for school staff and administrators, emphasizing secure data handling and phishing threat recognition.
- Adopt data minimization policies to limit the collection of non-essential personal information, particularly for historical records.
- Require transparent reporting of breaches within 72 hours of discovery, with detailed public disclosures and individualized notifications.
BACKGROUND:
1. PowerSchool Cybersecurity Event, The Guardian, Feb. 7, 2025 https://www.princeedwardisland.ca/en/information/education-and-
early-years/powerschool-cybersecurity-event
2. Cybersecurity breach exposes data of more than 70,000 P.E.I. students, teachers, Public Schools Branch https://www.saltwire.com/prince-edward-island/cybersecurity-breach-exposes-data-70000-pei-students-teachers 3. Personal data of 70,000 Island students stolen in PowerSchool breach, CBC
Jan 31, 2025 https://www.cbc.ca/news/canada/prince-edward-island/pei-powerschool-data-breach-update-1.7447385
~Passed as presented, April 12, 2025
Saturday, April 12, 2025
| Destination: | Department of Education and Early Years Department of Justice and Public Safety Minister of Justice and Attorney General of Canada Minister of Justice and Attorney General of PEI Premier of PEI |
Responses Received
Minister of Education and Early Years, Hon. Robin Croucher, Jun. 11/25: The DEEY is committed to ensuring that data breaches are reported in an expedient time frame. An example of this would be the recent PowerSchool breach where students, parents/guardians, and staff were notified within two (2) days of the Department becoming aware of the incident. The DEEY is working with the PSB and CSLF to ensure that data protocols are in place to ensure only required information is collected and guidance is clear on the contents of text fields in PowerSchool.
The PSB has indicated that board office staff have completed security training and that the system has received training on how to avoid cybersecurity threats.
The Department works closely with Information Technology Shared Services (ITSS) and Access and Privacy Services Office (APSO) when purchsing new approved software applications.
On behalf of the Department of Education and Early Years, we thank you for your continued advocacy to support PEI’s public education system.
Office of the Prime Minister, J. Genge, July 16/25:
On behalf of the Right Honourable Mark Carney, Prime Minister of Canada,I acknowledge receipt of your correspondence dated June 12, 2025, relating to the Online Harms Act. I regret the delay in replying. Please be assured that the remarks you offer on behlaf of Prince Edward Island Home and School F ederation Inc. have been carefully read.
As you have also sent your communication to the Minister of Justice and Attorney General of Canada and Minister responsible for the Atlantic Canada Opportuniities Agenday, teh Honourable Sean Fraser, and the Minister of Public Safety, the Honourable Gary Anandasangaree, the Prime Minister will leave the issues you raise to be considered by the Ministers.
Than you, once again, for writing.