Office of the Information and Privacy Commissioner releases Report P-2026-001 on the PowerSchool Privacy Breach
https://www.gov.nl.ca/releases/2026/oipc/0512n01/
Publish Date: 2026-05-12 09:00:00
Source Domain: www.gov.nl.ca
The Office of the Information and Privacy Commissioner (OIPC) has released its report examining the PowerSchool cyber attack that compromised the personal information of students, parents/guardians, and teachers across Newfoundland and Labrador’s K–12 education system. The Report, released on May 11, 2026 examines the actions of the Department of Education and Early Childhood Development (the Department), which is the public body responsible for safeguarding personal information held within the PowerSchool Student Information System (PowerSchool SIS).
What follows is an overview of some of the Report’s findings. To view the Report in its entirety, please go to www.oipc.nl.ca/reports/atippa-2015-privacy-reports/.
OIPC acknowledges the important work of Information and Privacy Commissioners in Ontario, British Columbia, and Saskatchewan, whose investigations and reporting on PowerSchool informed and supported this Office’s findings.
Acting under the authority of the Access to Information and Protection of Privacy Act, 2015 (the Act), Commissioner Kerry Hatfield initiated an own‑motion investigation to assess whether the Department had appropriate security measures in place at the time of the breach and whether it took reasonable steps in responding to the breach.
The PowerSchool privacy breach extended far beyond the current generation of teachers, students, and parents or guardians. Teacher personal information in PowerSchool SIS dated back to 2010. Student personal information in PowerSchool SIS dated back further to 1995, meaning anyone who attended as a student or had a child in the K–12 educational system in Newfoundland and Labrador from 1995 onward likely had personal information taken in the PowerSchool breach.
While the Report identified weaknesses in contractual language governing PowerSchool’s services with the Department, it concludes that the primary issue was not what PowerSchool committed to in its agreements but its failure to meet…
