The University of York could face legal action following the publication of personal records relating to a number of students. A full investigation to how the details were made available is underway and the Information Commissioners Office (ICO) has also been informed about the leak.
A statement on the University of York website fully details the breach and offers support to those affected. According to the website, this week 148 student records were made available to anyone without the need for any authorisation though a web page off the site itself.
The students effected had their personal information published which included name, date of birth, gender, home and emergency contact – including addresses. Also available were the student’s course details, department, course tutor, year of study and their entrance qualifications.
The university has contacted all those affected, offering a full apology, support and has acknowledged a review of its data management, stating: “We are investigating all procedures and data management systems and will undertake a thorough review of our data security arrangements. Results of this investigation, and recommendations from our Internal Auditors, will be used to make any necessary improvements to how we handle data in the future”.
Following an investigation by the ICO, if it is found to have been in breach of the Data Protection Act 1998, the University could face legal action and fine. Serious breaches of the Act can lead to the ICO handing fines of up to £500,000.
