Canada Border Services Agency’s Unauthorized Disclosure of Employee Personal Information Extracted from the Corporate Administrative Software Portal
The Office of the Privacy Commissioner (OPC) received complaints regarding the unauthorized disclosure of personal information of over 18,000 Canada Border Services Agency (CBSA) employees. These disclosures occurred when HR-generated spreadsheets, intended for specific operational purposes like shift scheduling, contained excessive personal data or were shared with unauthorized employees. The CBSA's internal investigation uncovered four additional similar breaches. The OPC found that these incidents contravened section 8 of the Privacy Act regarding disclosure limitations. However, the CBSA took appropriate steps to notify affected individuals, contain the impact of the breaches, and implement both short-term and long-term measures to prevent recurrence, including new data request procedures and a future information management system. Consequently, the complaints were deemed well-founded and resolved.
- 1Whether the CBSA's disclosure of employee personal information via spreadsheets contravened section 8 of the Privacy Act
- 2Whether the inclusion of excess information in spreadsheets constituted unauthorized disclosure
- 3Whether the use of personal email addresses for work-related data sharing contravened the Privacy Act
- 4Whether the CBSA took adequate steps to address the incidents, including notification to affected individuals
- 5Whether the CBSA's measures to reduce the risk of recurrence were reasonable
- Unauthorized disclosure: Contravention of Privacy Act s.8 found
- Remedial actions: Appropriate steps taken by institution
- Complaint outcome: Well-founded and resolved
Complaint well-founded and resolved
The OPC found that the CBSA contravened section 8 of the Privacy Act by disclosing excessive personal information. However, the CBSA's subsequent actions to notify affected individuals, contain the breaches, and implement corrective measures to prevent recurrence were deemed appropriate and satisfactory.
The CBSA implemented new procedures for HR data requests, including a 'HR Data Request Form' and 'HR Data Sharing Checklist', to ensure data is limited to what is necessary and shared only with authorized individuals. It is also developing a new information management system for long-term resolution.
- s.8(1) Privacy Act
- s.8(2) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro