NAPLAN Test Data Missing After Delivery Van Theft in Melbourne
The sensitive personal details of approximately 70 primary school students are still unaccounted for following the theft of a delivery van carrying completed NAPLAN tests in Melbourne’s inner-north. The incident, which occurred on March 17, has resulted in an “analogue data breach” affecting students from Princes Hill Primary School and Carlton North Primary School.
The vehicle, a FedEx van, was stolen from Pigdon Street in Carlton shortly after school concluded for the day. While the van was later recovered around the corner on Mary Street, the crucial contents – the NAPLAN tests – remain missing.
The exposed information includes names, dates of birth, year levels, and the specific schools of Year 3 students. Notably, these children had completed a writing task in their NAPLAN assessment, which involved a prompt about a rock. This means that not only basic demographic data but also potentially personal narratives written by young children are now in the public domain.
The ABC has learned that the subcontracted courier van was operating on behalf of Pearson Australia. This company holds a significant $4.4 million contract with the Victorian government to manage the printing, production, delivery, and collection of NAPLAN tests across Victoria.
Following the discovery of the theft, students were offered the option to re-sit the NAPLAN test. This test is administered by the Victorian Curriculum Assessment Authority (VCAA).
A spokesperson for the VCAA stated that upon learning of the theft, “immediate action” was taken to ensure affected families were notified and offered support. “While the police were able to recover the vehicle, the materials inside it had been removed and have not since been located,” the spokesperson confirmed.
However, a significant delay occurred in informing the affected families. Although the data breach was reported to the Office of the Victorian Information Commissioner on March 27, parents and guardians were not notified until April 1, a full 15 days after the incident.
One parent from Princes Hill Primary School expressed their shock and disbelief at the delayed notification. “We were told on April Fool’s Day so we thought it was a joke to begin with,” they revealed. “We didn’t hear anything from VCAA, just from our principal. We got one email saying they’d been stolen. There was no real follow up beyond that.”
The parent highlighted the emotional toll on the students. “I know it’s not VCE results but it’s still little kids who have poured their heart and souls into their stories, and everyone knows what it’s like to redo your work. It’s pretty annoying.”
This incident is the latest in a string of data security issues impacting Victorian students. Earlier this year, in January, hackers gained access to a Department of Education computer database, compromising the names, email addresses, schools, year levels, and passwords of students.
Esme Capp, the principal of Princes Hill Primary School, acknowledged in an email to parents that the potential exposure extended beyond basic personal information. “There is also the chance that the writing completed by your child during the test contained some personal information,” Dr Capp advised.
She conveyed the VCAA’s apologies, stating, “Although it was a private courier company that is responsible for this, the VCAA has apologised to us and asked us to pass on their apologies to you.”
The parent interviewed by the ABC voiced significant concerns about their child’s information being “out there somewhere.” They added, “You don’t know what personal information they’ve put in their story either. Who knows what they’ve written. There’s now a whole lot of bits of data about my child out there. It’s a major data breach. They really need to treat it more securely.”
Victoria Police have confirmed that they are continuing their investigation into the theft. As of the latest reports, no arrests have been made.
Key Details of the Incident:
- What happened: A delivery van carrying completed NAPLAN tests was stolen.
- When: March 17.
- Where: Stolen from Pigdon Street, Carlton, and recovered on Mary Street.
- Who is affected: Approximately 70 Year 3 students from Princes Hill Primary School and Carlton North Primary School.
- What information is missing: Names, dates of birth, year levels, schools, and student-written responses.
- Responsible parties: FedEx (courier), Pearson Australia (contractor), VCAA (administrator).
- Notification delay: Families were informed 15 days after the incident.
- Police involvement: Investigation ongoing, no arrests made.
The incident raises serious questions about the security protocols surrounding sensitive student data, particularly in an era where digital breaches are common, but physical theft of such information presents a unique and concerning challenge. The VCAA and Pearson Australia are expected to review their procedures to prevent similar occurrences in the future, ensuring the privacy and security of Australia’s young learners.
