[BreachExchange] JCPS technology coordinator fired over data breach

Destry Winant destry at riskbasedsecurity.com
Wed Jul 31 09:49:15 EDT 2019


http://www.newstribune.com/news/local/story/2019/jul/29/jcps-technology-coordinator-fired-over-data-breach/788510/

Jefferson City Public Schools' Board of Education decided last Friday
to fire a district technology coordinator who copied and transferred
files that included students' personal information from a work account
to a personal email account.

JCPS did not have a comment Monday, but deferred to the findings of
fact and conclusions of law provided in the board's decision issued
Friday on technology coordinator Tammy Ferry.

The district notified families and the public in May of the file
transfer — though Ferry was not named at the time as involved — and
said there was no evidence of identity theft as a result.

Related Article

Key questions arise in JCPS dismissal hearing

Read more

The files included students' Individual Education Programs, physical
therapy evaluations, physical therapy progress notes and other
records, which included a combination of one or more of students'
names, addresses, medical information and/or Missouri Student
Identification System numbers.

Ferry copied and transferred her work account files because she wanted
to be sure she would have them available for the upcoming trial in her
employment discrimination lawsuit against the district, its
superintendent and her immediate supervisor — as well as to have a
record of her work for future employment opportunities.

Ferry is suing JCPS, Superintendent Larry Linthacum and her supervisor
Joe Martin — JCPS director of technology — in Cole County Court,
alleging retaliation, sex discrimination and a hostile work
environment. The trial was originally scheduled for February and is
currently scheduled to begin Nov. 12.

Several former district employees testified as witnesses for Ferry at
a July 10 hearing on the district's recommendation to fire her that
they too had transferred work files to their personal email accounts,
but that they would not have had any confidential student data in the
transferred files or that they would have made sure not to transfer
files with such information.

The school board found that Ferry had willfully and persistently
violated several board policies on staff conduct, technology usage and
data governance and security; that Ferry's transfer of the data to her
own account was a disclosure prohibited under federal privacy law
regarding students; and that she did not have a "legitimate
educational interest when she transferred the data to her personal
email account."

The board also negated Ferry's defense that her actions were at the
direction of her attorneys, as the board "could not find, nor was it
directed to, any case finding that (the 'advice of counsel' defense)
has ever been used in administrative proceedings or in employment
termination hearings," according to its written decision to fire
Ferry.

The school board did not consider or address additional allegations
against Ferry that she had violated administrative directives during
the investigation into the file transfer to return district computers
in her possession, not talk to other district employees and not be on
district property.

The termination of Ferry's employment was effective immediately. Her
annual salary was $60,959, according to her 2018-19 contract.

Ferry told the News Tribune on Monday afternoon that she and her
attorneys would appeal the board's decision.

Her understanding was that the appeal would be in the county circuit
court and that a judge would rule either to let the termination stand
or to overturn it.

"You can see the reason that (the board) terminated me was because of
me transferring my work files, and I guess the only thing I would add
to that is I did nothing more than every other employee had the
ability to do and that many, many employees do routinely, and that no
student data was ever compromised or breached, no disclosure at all,"
Ferry said. "... I have not violated the law. I have not violated
board policy or FERPA in any way, and that's why we're appealing."


More information about the BreachExchange mailing list