At least 218 WA government schools deleted student records from the School Information System without proper authorisation between 2010 and 2021. The deletions violated the State Records Act 2000 and breached a 2018 disposal freeze on all records relating to childcare and education.

The Western Australia State Records Commission has issued its first special report to Parliament, detailing the unauthorised destruction of student records at the Department of Education.

The Commission found approximately 9,934 confirmed missing student records, with another 41,000 "orphan" records that could not be matched to student names. Recovery attempts from historic backups achieved less than seven per cent success.

"The premature deletion of records and loss of State archives stored in the SIS is a contravention of the Act," the report states.

The deleted records included State archives such as enrolment and admission records, attendance data, addresses, behavioural records and school reports. Under approved retention schedules, these must be kept for 25 years after the student's birthdate.

System Configuration Failures

The Commission determined the losses resulted from poor practices and improper system configuration rather than malicious intent.

"According to the Department, the system was not configured properly, allowing schools to have the ability to delete records in SIS without the relevant approvals," the report states.

Schools could delete records without approval from the Department's Manager of Corporate Information Services. The system also allowed schools to change default reference number settings, causing certain student sequence numbers to be skipped entirely.

The deletions violated the Department's own Records Management Policy, which requires two-step verification for disposal authorisation involving both the principal and Corporate Information Services.

Royal Commission Disposal Freeze Ignored

The deleted records were subject to a disposal freeze issued by the State Records Office on 5 April 2018, following the Royal Commission into Institutional Responses to Child Sexual Abuse.

The freeze requires indefinite retention of "all records related to the care, supervision, education and treatment of children where government employees, contractors, volunteers and outsourced service providers are in contact with children."

The Royal Commission recommended institutions retain child sexual abuse-related records for at least 45 years to allow for delayed disclosure by victims.

"These losses may also impact the investigation of historical abuse allegations and other matters," the report notes.

Remediation Actions

The Department discovered the issue in 2021 and immediately locked down schools' ability to delete student records or use the "Purge Leavers" function.

Additional measures included locking student reference numbering settings to ensure sequential numbers, requiring schools to apply to Department ICT staff for deletions with justification, and modifying SIS training to strengthen records management focus.

The Department investigated 200 schools initially, contacting 53 for historic backups. Only nine schools reported backups existed, and just six contained information not already on school servers.

The Department has confirmed the issue did not affect records in the Reporting to Parents system, which retained historical achievement data transferred from SIS since 2010.

The Commission issued two key recommendations for all government organisations subject to the Act.

First, organisations must review business system configurations to restrict record deletion to system administrators and records management staff, not operational users. Systems should monitor all access, modification and deletion of records.

Second, organisations must improve staff awareness of record keeping obligations through onboarding training, regular refreshers, and integration into business system training.

State Records Commission Chair Caroline Spencer, who is also Auditor General for Western Australia, acknowledged the Department self-reported the matter and undertook its own investigation.

"The Commission encourages this practice in the interests of integrity and continuous improvement," Spencer stated in the report's overview.

The Department accepted all recommendations and confirmed it has allocated substantial resources to investigate and remediate the issues. Lessons learned are being embedded in a new student information system designed with enhanced metadata capture, comprehensive audit logging and robust user permissions.

The Department's response noted that over 400 schools have participated in the School Archives Service established in 2019 to support long-term retention of school records following the Royal Commission recommendations.

The full report is available here.