School photo data potentially compromised after vehicle break-in | brief

A UK secondary school is facing a potential data protection issue after a company hired to take pupils' photographs reported a data theft. A vehicle belonging to the photography company, Pret-a-Portrait, was broken into between Oct. 6 and 7, resulting in the theft of a camera bag containing SD memory cards, according to a recent report by The Register.

The stolen SD cards may have contained photographs of pupils from Priory School in Lewes, along with QR code cards used during the photo sessions. These QR code cards reportedly included pupils' names and class names. The headteacher, Jon Curtis-Brignell, stated that the same equipment was used for other photography jobs after visiting Priory School. Pret-a-Portrait believes most, if not all, of the affected files have likely been overwritten, but cannot be certain. The potentially compromised data includes photographs, pupils' names, and class information related to the photography process. However, sensitive data such as addresses, details, financial, medical, and safeguarding records stored on the school's own systems remain unaffected. Pret-a-Portrait has taken steps to mitigate damage, including taking photos offline, changing access IDs, and updating procedures to wipe SD cards after each job. The company also reported the incident to the police and the Information Commissioner's Office (ICO).