Serious information security incident at educational institution: “Large amount of personal files”

Following a report from a private source obtained by the Privacy Protection Authority at the Ministry of Justice about a serious information security incident at an educational institution in Bat Yam, in which large amounts of personal files of students studying at the institute were dumped, including There are personal photographs, questionnaires, psychological assessments and other personal materials. The authority turned to the representatives of the educational institution and the municipality for immediate and immediate treatment.

Following the appeal, the educational institution took action to handle the incident and collected the exposed material. However, no serious security incident has yet been reported, as required by the Privacy Protection (Information Protection) Regulations.

In the context of the information security phenomenon, the Privacy Protection Authority emphasizes that any body that administers or holds personal information about people, certainly an educational institution that holds sensitive information about students and minors , he must ensure that it serves to protect and safeguard the information. in accordance with its privacy protection rules. , It should also be noted that the security obligations that apply to information in databases are also valid when it comes to printouts of information from databases, especially when it comes to sensitive information that is also subject to a duty of confidentiality.

Responsibility for the security of the information rests with the Administrator or any body of the information holder, in order to protect the personal information of the persons on whom it holds the information, including through processes of such collection, elimination or destruction. involved in the relationship. Information. Failure to comply with the provisions of the Privacy Protection Regulations may expose the body to administrative and criminal enforcement proceedings by the Authority and may even lead to civil claims of those persons, in addition to damaging the reputation of the infringing body. About whom the information was leaked.

It should be noted that the Authority works to strengthen cooperation with all government ministries, including the Ministry of Education, to strengthen the protection of privacy in the organization, including the implementation of privacy design mechanisms in the early stages of the new projects promoted by it. is included.

The Authority urges citizens to continue to update it on serious information security incidents, including information leaks, vulnerabilities or vulnerabilities in websites, apps or services containing personal information, so that it can take action and reduce the extent to which the public to address these incidents. violation of privacy. Email box will be inquired [email protected] When in the subject line, indicate “Information Security Incident Reporting”.