Confidential information regarding the health conditions and welfare of approximately 30 year 11 students at a Sydney high school was inadvertently sent to staff, students, and parents in an email intended to distribute a weekly newsletter. The staff member responsible mistakenly attached a confidential PDF titled “Welfare Watch” instead of the intended newsletter. Despite the subject line correctly identifying it as “Term 1 Week 5a,” the content within the document revealed sensitive information.
Efforts were made to retract the email and remove it from accounts where possible following its unintended distribution. The school, specifically the Blackwattle Bay campus of Sydney Secondary College, expressed deep apologies for the breach and acknowledged its inconsistency with the school’s commitment to respecting and safeguarding students’ and their families’ private information.
An investigation into workplace practices, led by the NSW education department with support from their cybersecurity team, is currently underway. The school has individually apologized to affected families and is in the process of addressing each student impacted.
The principal, Leiza Lewis, promptly issued an apology to parents, confirming the initiation of a work practices investigation and disciplinary inquiry into the staff member’s actions. The letter emphasized the immediate deletion of the mistakenly sent information and highlighted the ongoing investigation.
The chair of the Blackwattle Bay campus P&C, Jocelyn Prasad, characterized the incident as an unfortunate case of human error. The P&C expressed a desire to review the investigation’s findings and emphasized the commitment of the school’s dedicated teachers.
The Blackwattle Bay campus, located in Glebe, serves as the year 11 and 12 component of Sydney Secondary College, which includes 7-10 campuses at Balmain and Leichhardt. The NSW government schools operate under privacy laws to protect personal and health information, including the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002.
