Summary
- Memory cards were stolen from a Pret-a-Portrait vehicle overnight on 6–7 October.
- Priory School in Lewes says photographs, names and class information may have been present.
- The extent of any remaining data, access or misuse is unconfirmed; no school network intrusion was reported.
A break-in to a school photography contractor’s vehicle has raised questions about whether photographs and identifying information relating to pupils at a secondary school in East Sussex remained on stolen memory cards. Priory School in Lewes informed families that the cards may have held pupil images and photographed QR-code cards containing names and class details, according to reporting published on 16 October.
The contractor, Pret-a-Portrait, said a camera bag containing SD cards was taken during a vehicle break-in overnight between 6 and 7 October. It had photographed pupils at Priory School on 1 October and then used the same equipment for three more photography assignments. The company believes most or all of the relevant files may have been overwritten during that later work, but could not guarantee that every copy had gone.
The reported incident is a theft of physical media, not a disclosed intrusion into the school’s network. The potential information at issue is associated with the photography process: images, names, and class information. The school has not said that its medical, financial, safeguarding, or broader pupil information systems were accessed. Any description of a wider school data breach would therefore overstate the known facts.
The Register reported comments from headteacher Jon Curtis-Brignell and from the photography company’s owner, Nick Kerr. Their accounts establish that sensitive information may have been present and that its remaining existence cannot be verified with certainty. There has been no confirmed public report that the thief knew the cards contained school information, accessed the files, or used them for a separate purpose.
Removable media complicates a data inventory
School photography services depend on transferring data between cameras, storage cards, ordering systems, and suppliers. Those transfers create temporary copies that may remain outside the school’s direct technical control. The relevant questions include how long images remain on a card, when they are erased, whether erasure is verifiable, and what happens when a vehicle or bag is lost before the normal transfer process is complete.
Overwriting reduces the likelihood that ordinary file recovery will reveal earlier photographs, but the statement that files were probably overwritten is not equivalent to a forensic confirmation that no recoverable information remains. Storage technology, camera behaviour, formatting methods, and the location of data blocks can affect recoverability. The public record does not contain a forensic report about these cards, so a definitive exposure calculation is not possible.
Children’s photographs may carry particular sensitivity when connected with identifying details such as full names and class groups. The seriousness of a potential disclosure depends on which images and identifiers survived, who might access them, and whether the information could be linked with other sources. A risk assessment should not assume misuse simply from theft, but neither can it dismiss the question purely because the underlying crime appears opportunistic.
The school’s arrangement with its photography contractor placed pupil-related material on removable media outside the school’s direct technical control. A supplier may handle information only for a limited administrative task, while the school remains accountable for assessing the event and explaining relevant circumstances to parents. The status of notifications to regulators and the terms of the supplier’s contract are separate questions from whether the stolen data can actually be recovered.
A photograph and a QR card naming the pupil and class disclose different kinds of identifying information. An image alone may identify a child to someone who already knows them, while a QR card showing a name and class can supply structured context. Whether either category survived on the cards is presently uncertain. The contractor’s use of the equipment at later jobs introduces uncertainty about deletion rather than establishing it. Determining whether the incident is notifiable under data protection rules therefore depends on a risk assessment, not merely on the fact that the underlying offence was theft.
The contractor’s belief that later work overwrote the data may narrow the eventual exposure, yet it does not presently resolve uncertainty about what was on the stolen cards. The documented event remains a physical theft with a possible personal-data consequence, not evidence of a cyber intrusion or a confirmed malicious use of pupils’ information.
