The fallout from a data breach that exposed Social Security numbers of Lehighton Area School District employees and retirees carried into the school board’s meetings Monday, where residents accused the board of scapegoating the director who posted the records. A committee the board formed to study the breach also acknowledged Monday it met without public notice that its own solicitor said it should have given.

The breach stems from a Right-to-Know request from current director David Bradley that produced a large volume of district records. Bradley posted those records, which included unredacted Social Security numbers along with pension and financial information for district employees, retirees and their beneficiaries, on a personal website.

At a packed session May 14, teachers, parents and residents called for Bradley’s resignation, and board President Alex Matika, taking part remotely, called Bradley’s action “misconduct and malfeasance” and requested he step down.

Bradley argued the district, not he, was responsible for stripping personal information from the records before releasing them.

“The district accepted responsibility for action on Jan. 30, including all FERPA and HIPAA related information,” Bradley said. “We provided the district the next day with a full list of suspect documents, including the page numbers where the redaction errors may occur.”

Bradley also raised questions about the scope of the release.

“Two of the records that had a lot of suspect information appear to be records that were not even requested,” Bradley said.

Much of Monday’s public comment centered on a resolution the board passed at an earlier meeting, which several speakers said blamed Bradley before the facts were established.

“This is probably the worst thing that I would ever want to see a school board do, putting the egg before the chicken and basically putting someone into a position of being deemed a criminal without knowing the facts,” resident Ryan Bowman said.

Another resident faulted the board for shifting responsibility.

“That was totally your responsibility, and you failed,” Roy James said. “To blame it on a board member, I think, is just scapegoating. Our country is due process, and you’re innocent until proven guilty, and that’s not the way we’ve been acting.”

Not everyone was sympathetic to Bradley.

“My name, my Social Security number was put out on the Internet,” director Lori Frey, a former district employee, said. “He was not told to put it. It was his choice to put it on the Internet, not ours.”

The argument extended to who is legally responsible for protecting the data.

“He doesn’t have a responsibility under FERPA,” Bowman said. “He’s not a government entity. You have the responsibility. That is what FERPA is about.”

The dispute widened at the end of the night, when Bowman asked who serves on the board’s “breach committee.”

The ad hoc panel, appointed by Matika, includes board members Heather Neff, Denise Hartley and William Howland. Hartley said the group met last week and would bring the board recommendations, among them a new requirement that anyone receiving district records sign for them and that the district keep a copy.

“Is the ad hoc committee a public committee assigned by the board, or is it going to be a secret committee?” Bradley asked Monday.

Hartley said an ad hoc committee’s meetings are held at the members’ discretion and that announcing them publicly “would defeat the purpose,” then asked the solicitor for guidance.

“An ad hoc committee, if it’s going to be designed to make recommendations to the school board, should be publicly advertised,” Jeff Sultanik, the district’s solicitor said.

Hartley said the committee would handle its next meeting differently.

“Next time we have a public meeting, we will make the public aware, but at this point we have no additional meeting set,” she said.