More than 1,900 Henry Park Primary School students and their parents had their details leaked 2 weeks ago after the school mistakenly sent an email containing an Excel spreadsheet that contained the children’s and their parents’ particulars.
On 12th March, school administrators sent an email to parents about a school event, but ended up attaching the wrong excel file sheet to the email. The file contained names and birth certificate numbers of the students, an the names and contact details of their parents.
A full day after the leak, Mr Chia Soo Keng, the principal of Henry Park, sent an email apology to all parents and asked them to delete the Excel file and not to use the data.
The school is now reviewing all of its data handling procedures. For example, Mr Chia said that “all confidential information files are now password-protected.”
The Ministry of Education has also sent out its statement to apologize for the mix-up. “All schools have been reminded to use encryption as an additional means to protect personal data stored in files.”
It said that the employee who made the mistake has been counselled and the school has been asked to tighten its controls.
Parents who were approached by the media said they were still concerned. One parent said there was no way to ensure that the data would not be misused. A number of parents said that they hoped the Personal Data Protection Commission would step in to investigate.
However, the Commission says that MOE schools are exempt from the Personal Data Protection Act. The Act simply requires organizations to take reasonable measures to protect personal data in their care.
Public sector rules have their own set of data handling procedures, most of which have not been made public.