A Lake County school employee's email mistake handed one parent access to the private records of 47,000 students, and now the district says that parent is refusing to delete them. The Lake County School District has gone to court over the breach, which happened after the parent submitted a routine public records request.
According to WFTV, a district employee mistakenly emailed the parent a link containing thousands of student records after that parent had filed the records request. The district has confirmed the parent received 47,000 student records.
The recipient was a parent who had made a public records request. The specific information released and its sensitivity remain unclear.
District Says It Asked for the Records Back
WFTV reports that the district has asked a court to order the parent to destroy the records. The parent has refused to delete them, the district says.
With the parent declining to comply, the district has turned to the courts. WFTV reports the district has filed a complaint in circuit court seeking an injunction requiring the records to be destroyed.
Florida Law Gives Parents a Path to Court Too
Florida law is built around the idea that students and their parents have a right to privacy over education records held by public schools and agencies, according to Florida Statutes, Section 1002.22. The same statute allows an aggrieved parent or student an immediate right to go to circuit court for an injunction if a school official or employee refuses to comply with the law — the same legal tool the district itself now appears to be reaching for in reverse.
Lake County School District policy similarly requires prior written consent from a parent or eligible student before most education records can be released, with exceptions allowed by law, and it requires identity authentication before electronic records are disclosed, per the district's own policy on student records and release of information. The district's current predicament raises the question of how that safeguard failed to catch a single email link before it reached one parent's inbox.
Second Breach in Weeks for Lake County Schools
This is not the district's first records scare this fall. In October, Lake County Public Schools said records belonging to about 1,800 students had been inadvertently shared with an unauthorized recipient, a smaller but still significant lapse that ClickOrlando covered at the time. The 47,000-record breach is far larger in scale and involves a parent who, per the district, is actively resisting efforts to have the material destroyed.
Student data breaches are not unique to Lake County. In California, a breach involving testing provider Educational Testing Service exposed data belonging to millions of current and former public-school students, with an unauthorized party using a compromised login credential to access and copy files between May and September, according to the Los Angeles Times. A 2020 federal review by the U.S. Government Accountability Office found that thousands of K-12 students nationwide had personal information compromised in data breaches between 2016 and 2020, underscoring how often school districts and vendors mishandle sensitive student files even without a hack involved.
For now, the Lake County case hinges on what a circuit court judge decides about the records already sitting with one parent. The district has not said whether the material has been destroyed, whether an affidavit has been signed, or how the court fight will be resolved.
