Mechanical malfunction, compounded by human error, leads to data spill
In March 2009, Human Resources and Skills Development Canada (HRSDC) mailed 11,900 forms for the Guaranteed Income Supplement. Due to a mechanical malfunction and human error, some individuals received forms intended for others, containing names, addresses, and Social Insurance Numbers (SINs). The OPC initiated a complaint after HRSDC notified them of 44 reported cases of mix-ups. The investigation found that a technician failed to stop the mailing despite noticing errors and did not report the issue to management. The OPC determined the complaint was well-founded, highlighting both mechanical failure and human error. HRSDC conducted its own investigation, improved equipment, and strengthened quality control procedures. The OPC recommended better employee sensitization to privacy obligations, which HRSDC committed to implementing.
- 1Whether personal information was inappropriately disclosed due to mechanical malfunction
- 2Whether personal information was inappropriately disclosed due to human error
- 3Whether the institution adequately safeguarded personal information during mass mailings
- 4Whether employees were sufficiently sensitized to their obligations to safeguard personal information
- Privacy breach: Complaint well-founded
- Mechanical failure: Contributed to breach
- Human error: Contributed to breach
- Remedial actions: Equipment improved, procedures strengthened
- Employee training: Better sensitization recommended and committed
Complaint well-founded — corrective measures taken and recommendations accepted
The OPC found that personal information was disclosed due to a combination of mechanical malfunction and human error, constituting a contravention. However, the institution took corrective measures and committed to implementing the OPC's recommendations.
The OPC recommended that Human Resources and Skills Development Canada better sensitize employees to their obligations to safeguard personal information, and the department undertook to update its employees’ knowledge of the Privacy Act and related policies and procedures.
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro