Product bulletin 126 - Privacy Incident Report: PowerSchool Student Contact Addresses

Nov 17th, 2022

Issue Overview

Some Edsby sites using PowerSchool had identified a minor deficiency in the way Edsby was bringing in address information for student contacts. Edsby was not including Unit/Apt information. The Edsby team created a fix for this PowerSchool integration deficiency that went live on October 20th, 2022 after passing internal testing.

On November 16th, 2022 an Edsby customer that uses PowerSchool reported an anomaly in which parents that lived apart were shown as having the same address in Edsby, and that was the address of the student.

Initial investigations on Nov. 16th led to the conclusion that the minor change made on October 20th was incorrect. It substituted the student address (which had an appropriate concatenation of the Unit/Apt information in it) as the address information for the student contact record.

The outcome resulted in some student contact records having an incorrect address. In the case of a household where the student and both parents live together, there was no discernable difference. In the case of a household with parents/guardians living in different locations, they all indicated the address of the student, which was likely only correct for one of the contacts.

Note that this address information was not prominent in the Edsby user experience. Parents could only have seen this when activating their Edsby account for the new school year, or if they explicitly navigated to “Settings” then “Personal Information” to review. Since the change in question went live well after the start of the school year, this likely accounts for why it took so long for a report of the issue to be made.

Also note that parents/guardians without explicit “Access to Records” set within the Student Information System would not have been able to see this information at all since they wouldn’t be allowed to log in to Edsby.

Issue Scope

This issue only affected a handful of Edsby sites using PowerSchool’s Contacts_TR mode. These sites are the explicit recipients of this bulletin. Other Edsby PowerSchool sites that do not use “TR mode” were not susceptible to this anomaly. Nor were Edsby sites using any other student information or management system, which represent the majority of the Edsby installed base.

Issue Response

The Customer Success team confirmed the issue on the evening of Nov. 16th. The Edsby engineering team reviewed the analysis on the morning of Nov. 17th, and concluded the best approach for rectifying this was to back out the original change. This change is scheduled to be performed this evening, Nov. 17th, 2022, and will correct the address information issue for all student contacts coming from PowerSchool. A proper fix for the Unit/Apt information shortcoming will be scheduled at a later date.
Issue Closure Confirmation
 
The Edsby team will send out a confirmation message on Nov. 18th to affected sites to confirm the change performed was successful and that address information has reverted.

Information at Risk

The only information affected by this issue was street address information for a small subset of students in certain households types as detailed above. And this incorrect information would only have been visible to the actual parents of this student who had access to information enabled. This issue did not affect any other information in Edsby.

Root Cause Analysis

Bugs do occur in any new software development, and independent testing is key to verifying that software is working as expected. In this case independent testing was done, but it focused solely on confirming the intended goal was achieved (Unit/Apt# was available in the address information) but did not verify it was being delivered appropriately across different kinds of family structures.

Summary

Edsby takes its responsibility to protect the data it is entrusted with very seriously. We have committed to our customers to inform them of any privacy issue we discover in the course of managing the information we’re entrusted with. Please reach out to Customer Success or privacy@edsby.com if you have any questions regarding this issue.