Psychological assessments for pupils left exposed in former Ruovesi restaurant

Sensitive school records belonging to pupils, including psychological assessments, were found scattered around a former restaurant called Popo in Ruovesi earlier this year, YLE reports. Papers dating from several decades were left on the premises. Some lay on the bar counter while both municipal employees and outsiders visited the site.

Ruovesi’s administrative director Ville Happonen says the education department archives were moved into the restaurant space in January to allow sorting after indoor-air problems at the previous Luottola building. Staff had kept files in boxes, folders or other containers. Happonen acknowledges that outsiders entered the premises and that at least one person viewed the documents, and he says the municipality did not file a data breach notification.

Deputy Data Protection Ombudsman Annina Hautala said the data must be protected even in temporary locations: "The data must be protected so that outsiders do not have access to them," and she said the municipality should assess whether a breach report is required. Ruovesi says the archive was removed from the restaurant at the end of June and moved to a municipally owned building, and that a larger project to organise archives is underway.

The incident follows recent regional concerns about mishandled personal data, including the Pirkanmaa wellbeing authority's dismissal of a specialist earlier this year over a serious privacy breach related case in March.