Federal department loses data on 5,000 people

Howard Solomon

11 years ago

What a way for the year to end.

The federal Human Resources and Skills Development department has acknowledged that a staffer lost a USB stick with personal information on 5,000 Canadians, including their social insurance numbers, medical records and birth dates.
The story was broken first by the London Free Press, then followed up by The Globe and Mail and other news organizations.

Early reports couldn’t confirm whether the data on the stick was encrypted.

UPDATE: According to the Toronto Star, an HRSD spokesperson said the data wasn’t encrypted.

The disgrace, of course, is that this comes after Elections Ontario’s humiliating admission in July that contract staffers lost two unencrypted USB sticks with personal information on as many as 4 million voters.

The loss of the data stick occured in November, and was reported to the federal privacy commissioner Dec. 21, wasn’t publicly acknowledged by the department until the Free Press asked about it.

There was one sign the department knew what to do — it informed those 5,000 people of the data loss and told them to be on the lookout for suspicious activity.

Still, there’s a lot more that needs to be explained including the circumstances under which the stick was lost, why it wasn’t encrypted and how fast the department acted.

Anne-Marie Hayden, a spokesperson for the privacy commissioner, said in an email to IT World Canada that Human Resources should answer questions about whether the data was encrypted.

Hayden said the privacy commissioner’s office is working with Human Resources to determine what took place, what it is doing to mitigate the situation, and what measures are being put into place to ensure a loss does not reoccur.

By about 4:30 Friday about 90 persons had called the privacy commissioner expressing concern to our office about the incident, Hayden added. In at least a couple of cases individuals have filed official complaints.

Read the original news stories here and here.