January 20, 2025Gatineau, Quebec
Privacy Commissioner of Canada Philippe Dufresne today issued the following statement regarding a privacy breach at PowerSchool, an education technology software company that provides services to several school boards and schools in Canada:
I am aware of reports of a cybersecurity incident at PowerSchool that affected educational platforms that are used in many Canadian schools.
My Office is in contact with the company to obtain more information about this breach and to provide them with information about breach response and reporting requirements under privacy legislation. This will allow us to convey our expectations to the company regarding their response to the breach and to determine next steps.
I am also in contact with my provincial and territorial counterparts regarding this matter.
Championing the privacy rights of children is one of my strategic priorities as children’s personal information is particularly sensitive.
I am concerned about the potential impact that an incident such as this one may have on the personal information of students across the country. Federal privacy law requires that organizations protect personal information with security safeguards appropriate to the sensitivity of the information. This is particularly important when dealing with children’s personal information.
Related links
Preventing and responding to a privacy breach
What you need to know about mandatory reporting of breaches of security safeguards
Office of the Privacy Commissioner of Canada – Strategic Plan 2024-2027
Media contact
Office of the Privacy Commissioner of Canadacommunications@priv.gc.ca
