IP54-56/2014 — Employment and Social Development Canada
The Office of the Privacy Commissioner of Canada (OPC) initiated a complaint against Employment and Social Development Canada (ESDC) following the loss of an unencrypted external hard drive containing the personal information of 583,000 Canada student loan borrowers and 250 ESDC employees. The investigation found that ESDC failed to implement adequate physical, technical, administrative, and personnel security controls, leading to contraventions of sections 6(3), 7, or 8 of the Privacy Act. The lost data included highly sensitive details such as Social Insurance Numbers, names, addresses, dates of birth, and comprehensive student loan financial information. While ESDC took extensive mitigation steps post-incident, including public notification and credit protection offers, the OPC concluded the complaint was well-founded due to the systemic failures in safeguarding personal information. ESDC accepted all ten of the OPC's recommendations aimed at improving its privacy management framework, and was well-advanced in their implementation. The OPC will conduct a follow-up review in one year to confirm full implementation.
- 1Whether ESDC failed to implement adequate physical security controls for personal information stored on portable media.
- 2Whether ESDC failed to implement adequate technical security controls, such as encryption and risk assessments, for personal information on portable media.
- 3Whether ESDC failed to implement adequate administrative controls, including asset inventory, information classification, and lifecycle management, for personal information.
- 4Whether ESDC failed to implement adequate personnel security controls, such as employee training, awareness, and accountability, regarding personal information.
- 5Whether ESDC contravened subsection 6(3) of the Privacy Act by failing to properly dispose of personal information.
- 6Whether ESDC contravened section 7 of the Privacy Act regarding the use of personal information.
- 7Whether ESDC contravened section 8 of the Privacy Act regarding the disclosure of personal information.
- 8Whether the delay in notifying affected individuals of the breach was reasonable.
- 9Whether the scope of personal information reported to affected individuals in the notification letters was complete.
- Physical safeguards: Contravention found
- Technical safeguards: Contravention found
- Administrative safeguards: Contravention found
- Personnel safeguards: Contravention found
- Privacy Act compliance: Complaint well-founded
- Recommendations: Recommendations accepted by institution
- Follow-up review: Follow-up review scheduled
Complaint well-founded — recommendations accepted and conditionally resolved
ESDC failed to implement appropriate physical, technical, administrative, and personnel security controls, leading to the loss of a hard drive containing sensitive personal information, thus contravening sections 6(3), 7, or 8 of the Privacy Act. However, ESDC accepted all recommendations and was well-advanced in their implementation, with a follow-up planned.
The OPC recommended 10 specific measures for ESDC to implement, covering physical, technical, administrative, and personnel security controls, which ESDC accepted in full.
- s.3 Privacy Act
- s.6(3) Privacy Act
- s.7(a) Privacy Act
- s.8(1) Privacy Act
- s.8(2) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro