Thief snatches school snapper's SD cards in smash & grab

UK school admits data protection bungle as children's data at risk

An old-fashioned smash-and-grab job on a photographer’s vehicle threatens the security of pupils’ data as a UK secondary school says it faces a potential data protection pickle.

Jon Curtis-Brignell, headteacher at Priory School in Lewes, said in an email this week that a company the school hired to take pupils’ annual school photos has alerted it to a data theft case after a vehicle was broken into.

“Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” Curtis-Brignell wrote. 

REG AD

“Some of these cards may have contained photographs taken at Priory School, together with images of the QR code cards used for school photographs, which show pupils’ names and class names.”

REG AD

The headteacher said that the same equipment used to take the photos at Priory School was also used for three additional photography jobs after Pret-a-Portrait visited the school on October 1.

Pret-a-Portrait, which has offices in the UK, Qatar, and the UAE, told the school that it believes “most, if not all” of the files containing pupils’ data will have been overwritten as a result, but it cannot be certain.

Curtis-Brignell said that the potentially affected information included photographs, pupils’ names, and their “class information associated with the photography process.”

Other types of data, such as addresses, contact details, financial information, medical information, and safeguarding records stored in the school’s own systems remain untouched.

Nick Kerr, owner of Pret-a-Portrait, told The Register that no physical, printed photos were stored in the vehicle at the time of the break-in, and that it was not possible to determine the potential scope of the data protection violation.

“As the email from Priory School explains, it is likely to be somewhere between a small subset of their pictures and none of them,” said Kerr.

On a positive note, he said that there is nothing to suggest the files have been improperly accessed.

“Our analysis reveals that no improper access to pictures from this job occurred in between the time of the theft and the pictures being taken offline.”

REG AD

Per the headteacher’s email, Pret-a-Portrait confirmed that it took a number of steps to mitigate the potential damage, including taking all school photos offline, changing the IDs used to access them, and changing its procedures so that all SD cards are wiped at the end of each commission.

The company also “reviewed and strengthened its procedures following the incident,” and reported the matter to both the police and the ICO.

“I appreciate that receiving an email of this nature may understandably cause concern,” Curtis-Brignell added. “We have worked closely with our Data Protection Officer and Pret-a-Portrait to understand what happened, establish the potential risk and ensure that appropriate action has been taken. 

“We wanted to be open with families about what has happened, while also reassuring you that there is currently no evidence that the information has been accessed or misused and that a number of steps have now been taken to prevent access to the affected photographs and reduce the risk of a similar incident occurring again.” ®