WHEREAS    on January 7, 2025, a cybersecurity incident involving PowerSchool, the

student information system used by Prince Edward Island schools, resulted in unauthorized access to personal data of past and present Island school members, including names, dates of birth, addresses, phone numbers, and other sensitive information, and

WHEREAS    the breach exposed highly sensitive records spanning decades, including medical information, custody arrangements, and disciplinary notes, impacting over 70,000 individuals in PEI alone, with similar incidents affecting schools nationwide;

THEREFORE, BE IT RESOLVED that the PEI Home and School Federation calls upon the federal government to:

1. Enact comprehensive legislation to strengthen data protection measures for educational institutions and third-party service providers, requiring encryption, multi-factor authentication, and annual cybersecurity audits.
2. Establish clear guidelines for the retention and deletion of outdated personal information, ensuring data minimization and prohibiting indefinite storage beyond operational necessity.
3. Mandate strict penalties for non-compliance with privacy laws, including fines for failure to implement safeguards or promptly disclose breaches.

BE IT FURTHER RESOLVED that the PEI Home and School Federation urges the provincial government to:

1. Conduct a thorough review of all third-party educational technology providers, requiring proof of compliance with federal privacy standards (e.g., PIPEDA) before contract renewal.
2. Implement mandatory cybersecurity training for school staff and administrators, emphasizing secure data handling and phishing threat recognition.
3. Adopt data minimization policies to limit collection of non-essential personal information, particularly for historical records.
4. Require transparent reporting of breaches within 72 hours of discovery, with detailed public disclosures and individualized notifications.

BACKGROUND:
1. PowerSchool Cybersecurity Event, The Guardian, Feb. 7, 2025 https://www.princeedwardisland.ca/en/information/education-and-early-years/powerschool-cybersecurity-event

2. Cybersecurity breach exposes data of more than 70,000 P.E.I. students, teachers, Public Schools Branch https://www.saltwire.com/prince-edward-island/cybersecurity-breach-exposes-data-70000-pei-students-teachers 3. Personal data of 70,000 Island students stolen in PowerSchool breach, CBC Jan 31, 2025 https://www.cbc.ca/news/canada/prince-edward-island/pei-powerschool-data-breach-update-1.7447385