Chicago Skyline Chicago skyline. (Photo: Shutterstock)

Detention is probably not going to cut it this time around. According to the Chicago Sun-Times, a former Chicago Public Schools contractor named Kristi Sims stands accused of stealing data pertaining to 80,000 employees, volunteers and vendors from a school database.

The case illustrates the complexity of the client/vendor relationship, specifically when it comes to accountability following the exposure of personal data. Determining where the liability may fall could depend as much on pre-existing contracts as it does any kind of state law.

“The CPS incident brings up a lot of best practices because we see this a lot with respect to schools, with respect health care facilities, with respect to all businesses that hold this identifiable data. They're working with vendors every day,” said Valerie Montague, a privacy professional and a partner with Nixon Peabody.

And sometimes those vendors forget to flip off the switch. The contracting company that employed Sims had recently terminated her for performance-based issues but neglected to revoke her access to the board of education's Google Drive account, allowing her to remotely compromise sensitive information such as employee ID numbers, addresses and dates of birth.

The question of who could be held responsible—CPS or the contracting company—is a little bit like the chicken and the egg. Montague thinks that, if an investigation or lawsuit of any kind were to materialize, the school would probably be the primary target. Timothy Hayes, an associate focusing on privacy and cybersecurity, thinks there's a chance the liability could be split both ways.

“As the entity that collected the data, the CPS had a duty to the individuals whose data they collected to protect that data and to ensure that any third parties handling that data also protected that data. Also, the contractor whose mishandling of the data resulted in the breach had a duty to the CPS to protect the data they were contracted to handle,” Hayes said.

In Illinois, the Student Online Personal Protection Act is the only school-specific state law regulating data privacy and security, but then it applies mostly to educational technology companies. SOPPA prohibits the sale of student data along with using it to create student profiles or engage in targeted advertising.

The data that Sims allegedly stole from CPS' database wouldn't qualify as “personal information” under Illinois law. No Social Security numbers, driver's license numbers or medical/health insurance information were taken, so it wouldn't have triggered any of the state's breach notification laws either. In these instances, the currency at stake is public opinion.

“Not only do parents trust that schools will keep their children physically safe, but there is an expectation that schools will keep their children's data and identities safe, as well. Repairing any damage to that relationship falls on every member of a breach response team, including the lawyer,” Hayes said.

Protecting clients like schools or corporations often begins prior to a formal relationship with a vendor even commencing. Nixon Peabody advises those under their guidance to perform a thorough review of the policies and procedures a contractor incorporates to secure data. For example, asking how quickly access can be revoked to former employees couldn't hurt.

Once talks reach the contract stage, clearly-defined language designating the burden of liability can help eliminate any potential ambiguity in the event of an incident.

Montague noted that, “if your organization is pursued by a regulator or by an individual, you can then take your contract and pursue your vendor for failure to meet the requirements of the contract to protect that data. And to terminate access for an employee who is no longer with the organization.”