Psychological assessments found in former Ruovesi restaurant

Yle has found that sensitive documents concerning schoolchildren were left around a former restaurant in Ruovesi, in Finland’s Pirkanmaa region, in a possible data security breach.

Documents from different decades were reportedly left in various parts of the premises. Psychological assessments of pupils were visible on the bar counter.

Municipal employees, renovation workers and other outsiders entered the restaurant while the archive papers were there. Several people may have seen sensitive information without authorisation. Yle’s sources said at least one person looked at the documents.

Yle is not publishing the names of its sources because doing so could cause them harm.

Municipality says documents were stored appropriately

Ruovesi municipal manager Ville Happonen said the archives of the municipality’s education department were moved to the premises of the former Popo restaurant for temporary storage in January. The municipality owns the commercial premises.

According to employees who worked with the archive, the documents were stored appropriately in folders, binders or boxes, Happonen said.

The municipality said the archive included documents from schools and the education department, as well as early childhood education documents such as applications, decisions and early childhood education plans.

The papers had originally been kept in Luottola, a building previously used by the education department. They could not be sorted there because of indoor air problems.

“We considered in the management team what would be a space safe for people’s health where the archive could be sorted,” Happonen said.

Several people entered the premises

Happonen acknowledged that outsiders entered the premises while the sensitive papers were present. A burst pipe had led to renovation work there before the municipality had removed the documents.

“I was also told that these people should not have been able to see the papers,” Happonen said.

Workers from the municipality’s workshops also visited the premises to collect furniture, among other things. Happonen said employees of the workshops were bound by confidentiality through their employment contracts with Ruovesi.

He acknowledged that workshop workers should not have had access to documents of this kind. The workshops have more than 10 people in total, some of whom take part in rehabilitative work activities and are not employed by the municipality.

Several Ruovesi library employees also visited the former restaurant, technical manager Waltteri Martelin confirmed. They inspected the premises because it is due to be used temporarily by the library, which is moving from its current facilities because of indoor air problems.

Later, a contractor’s representative visited the premises with the technical manager or property manager to plan the renovation.

No data breach notification was filed

Ruovesi did not report the incident as a data security breach.

Happonen said he had not been told that anyone who was not authorised to view the documents had actually looked at them. He said the premises were locked and that the municipality had several keys. The housing company that owns the building also had a key.

A data security breach occurs when personal data is destroyed, lost or altered, disclosed without authorisation, or accessed by someone without the right to process it.

A data controller must notify the Office of the Data Protection Ombudsman if a breach could pose a risk to people’s rights and freedoms. The deputy data protection ombudsman said personal data must be protected from unauthorised access even when it is kept in a temporary location.