Lost USB key from Employment and Social Development Canada reinforces lessons learned
This report details an investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants from an ESDC office. The USB key, which was neither password-protected nor encrypted, contained sensitive data including SINs, medical conditions, and dates of birth. The investigation found weaknesses in physical, technological, administrative, and personnel controls at both ESDC and Justice Canada, as a Justice Canada lawyer had custody of the key when it went missing. The OPC concluded that both departments failed to translate their privacy and security policies into meaningful business practices. Both ESDC and Justice Canada accepted nine recommendations from the OPC to improve their protection of personal information.
- 1Whether Employment and Social Development Canada (ESDC) adequately protected personal information on a lost USB key
- 2Whether Justice Canada adequately protected personal information on a lost USB key while in its custody
- 3Whether physical controls for personal information were adequate
- 4Whether technological controls (encryption, password protection) for personal information were adequate
- 5Whether administrative controls for personal information were adequate
- 6Whether personnel controls for personal information were adequate
- 7Whether ESDC translated its privacy and security policies into meaningful business practices
- 8Whether Justice Canada translated its privacy and security policies into meaningful business practices
- Safeguards for personal information: Weaknesses found in physical, technological, administrative, and personnel controls
- Policy implementation: Departments failed to translate policies into meaningful business practices
- Recommendations: Both departments accepted nine recommendations
Action warranted — recommendations accepted by institutions
The OPC found significant weaknesses in privacy management controls at both ESDC and Justice Canada, leading to the loss of sensitive personal information. While not explicitly stating a 'well-founded' contravention, the report's findings of policy failures and the issuance of recommendations that were accepted by the institutions indicate that action was warranted to ensure compliance.
The OPC recommended that both Employment and Social Development Canada and Justice Canada implement nine specific measures to better protect personal information under their control, which both departments accepted.
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro