PIPEDA Findings #2020-005: Investigation into Desjardins’ compliance with PIPEDA following a breach of personal information between 2017 and 2019
The Office of the Privacy Commissioner of Canada (OPC) investigated a major data breach at Desjardins that affected close to 9.7 million individuals in Canada and abroad between 2017 and 2019. The breach was caused by a malicious employee who exfiltrated sensitive personal information, including names, dates of birth, social insurance numbers, and transaction histories. The OPC found that Desjardins contravened PIPEDA's principles regarding accountability, retention periods, and security safeguards. Specifically, Desjardins had inadequate organizational policies and procedures, critical gaps in employee training and awareness, ineffective access controls and data segregation, and insufficient oversight and monitoring. Additionally, Desjardins failed to handle personal information in accordance with retention and destruction requirements, retaining some inactive files for decades. While the complaints were found to be well-founded, Desjardins' mitigation measures offered to affected individuals were deemed adequate. Desjardins committed to implementing the OPC's recommendations to address the identified weaknesses.
- 1Whether personal information held by Desjardins was protected throughout its life cycle by security safeguards appropriate to the sensitivity of the information as required by PIPEDA Safeguards Principle 4.7.
- 2Whether Desjardins fulfilled its responsibilities to implement procedures to protect personal information and train its staff, as set out in Accountability Principle 4.1.
- 3Whether the personal information of individuals was handled in accordance with the retention and destruction requirements as set out in PIPEDA Principle 4.5, limiting use, disclosure and retention.
- 4Whether the mitigation measures offered by Desjardins to affected individuals were adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with PIPEDA Safeguards Principle 4.7.
- Accountability principle: Contravention found
- Retention periods: Contravention found
- Security safeguards: Contravention found
- Mitigation measures: Deemed adequate
- Complaint outcome: Well-founded
Complaints well-founded and conditionally resolved
Desjardins contravened PIPEDA principles for security safeguards, accountability, and retention due to systemic failures in its policies, training, access controls, monitoring, and data destruction practices, but committed to implementing corrective measures.
The OPC recommended that Desjardins provide six-month progress reports on safeguarding actions, finalize and submit a retention schedule and destruction process within six months, delete or anonymize expired personal information, demonstrate improved monitoring of access and transfer requests, implement additional protections for personal information on employee computers, and retain an external auditing firm to assess and certify its information security and privacy program within two years.
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- Principle 4.7.3 PIPEDA
- Principle 4.7.4 PIPEDA
- Principle 4.1 PIPEDA
- Principle 4.1.4 PIPEDA
- Principle 4.1.4(a) PIPEDA
- Principle 4.1.4(c) PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.5.3 PIPEDA
- s.1.1 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro