Investigation of the loss of an unencrypted Universal Serial Bus (USB) storage device by the Royal Canadian Mounted Police
The Office of the Privacy Commissioner of Canada (OPC) investigated the Royal Canadian Mounted Police (RCMP) following the loss of an unencrypted USB storage device containing sensitive personal information of 1,741 individuals. The investigation focused on whether the RCMP contravened section 8 of the Privacy Act regarding disclosure, the appropriateness of its breach response, and the sufficiency of its safeguards for USB devices. The OPC found that the RCMP contravened section 8 due to unauthorized disclosure, as the device was lost, unencrypted, and its contents were copied and offered for sale. While the RCMP's notification to affected individuals and mitigation steps were generally appropriate after discovery, the initial reporting of the loss was significantly delayed. Furthermore, the RCMP failed to implement adequate safeguards, as its own policies for procurement, inventory, and encryption of USB devices were not followed, and security awareness training was insufficient. Despite the RCMP accepting the OPC's recommendations to strengthen safeguards, audit procedures, and awareness programs, it refused to commit to specific timelines for implementation. Consequently, the complaint was found to be well-founded and unresolved.
- 1Whether the RCMP disclosed personal information in contravention of section 8 of the Privacy Act
- 2Whether the RCMP's response to the privacy breach was appropriate in the circumstances
- 3Whether the RCMP's measures to protect personal information contained on USB storage devices were sufficient
- 4Whether RCMP personnel failed to report the loss of the USB storage device to authorities in a timely manner
- 5Whether the RCMP's policies and procedures for procurement, inventory, and encryption of USB devices were followed and enforced
- 6Whether the RCMP's security and privacy awareness training for members was effective and sufficient
- 7Whether the RCMP's policy compliance monitoring for USB device use was adequate
- Unauthorized disclosure: Contravention of s.8 Privacy Act
- Breach response: Notification and mitigation generally appropriate, but reporting delayed
- Safeguards for USB devices: Inadequate safeguards and policy non-compliance
- Complaint outcome: Well-founded and unresolved
Complaint well-founded and unresolved
The OPC found the complaint well-founded because the RCMP contravened section 8 of the Privacy Act through unauthorized disclosure of sensitive personal information and failed to implement adequate safeguards for USB devices. The complaint remains unresolved as the RCMP, despite accepting the OPC's recommendations, refused to commit to timelines for their implementation.
The Commissioner recommended that the RCMP demonstrate measures are in place to ensure only approved (encrypted, password-protected) USB devices are used, including an IT alert system for unauthorized connections; develop and implement an audit procedure for returning USB devices after use; and review and revise its security and privacy policies and awareness programs to ensure continual reminders and proper breach reporting from all levels.
- s.8 Privacy Act
- s.8(1) Privacy Act
- s.8(2) Privacy Act
- s.29(3) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro