Canada Privacy Commission Resolves PowerSchool Investigation
The Office of the Privacy Commissioner of Canada will halt its investigation of PowerSchool after the tech firm pledged to bolster countermeasures following a Dec. 2024 cyberattack that exposed the data of millions of students, educators and parents, the privacy watchdog announced Tuesday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Canadian Privacy Commissioner Phillipe Dufresne launched the investigation in February (see 2502110031).
The decision to stop the investigation "does not affect ongoing investigations by provincial Information and Privacy Commissioners in Ontario and Alberta, who are actively examining the breach from the perspective of the school boards and schools under their respective privacy laws," according to the release.
“Federal privacy law requires that organizations protect personal information with security safeguards appropriate to the sensitivity of the information," said Dufresne. "This is particularly important when dealing with children’s personal information.”
PowerSchool's breach compromised data of 60 million people across North America. It led to several lawsuits alleging the company’s negligence prompted the incident (see 2501220057 and 2505120026). In January, PowerSchool said it was resolving issues that led to the breach (see 2501220093).
In May, a 19-year-old Massachusetts college student was charged and agreed to plead guilty to hacking into the academic software company's network and causing the data breach (see 2505220037).
North Carolina Attorney General Jeff Jackson (D) also investigated PowerSchool starting in February (see 2502060055), and demanded the educational platform share more information about the breach in June (see 2506240065).