Phoenix pay system compromised Public Servants’ privacy
The Office of the Privacy Commissioner (OPC) investigated three complaints concerning Public Services and Procurement Canada's (PSPC) Phoenix Pay System. Complainants alleged improper disclosure of federal public service employees' personal information, with PSPC being aware of privacy issues before the system's launch. The OPC's investigation revealed at least 11 breaches, more extensive than initially reported by PSPC, involving employee names, Personal Record Identifiers (PRIs), and salary information, with government-wide vulnerabilities. These breaches stemmed from inadequate testing, coding errors, and insufficient system controls. The OPC found that PSPC failed to adequately monitor access to personal information, provide timely and sufficient notification to affected individuals, and fully address known vulnerabilities. Consequently, the OPC found the complaints to be well-founded and issued six recommendations to PSPC, some of which PSPC's proposed actions were deemed inconsistent or insufficient by the OPC.
- 1Whether personal information was at issue in the reported incidents
- 2Whether the personal information at issue was improperly disclosed
- 3What was the scope of the improper disclosure
- 4Whether the personal information that was improperly disclosed was misused
- 5Whether PSPC was aware of potential privacy issues with Phoenix before the launch
- 6What kind of harm could result from the unauthorized disclosure of the personal information at issue
- 7Whether PSPC resolved all of the vulnerabilities within Phoenix
- 8Whether PSPC provided individuals with timely information regarding the breaches and vulnerabilities
- 9Whether PSPC developed and implemented controls to monitor and document access to personal information held in Phoenix (Recommendation 1)
- 10Whether PSPC developed more robust testing and response procedures (Recommendation 2)
- 11Whether PSPC conducted necessary assessments to identify potential risks and vulnerabilities in Phoenix (Recommendation 3)
- 12Whether PSPC took measures to mitigate the increased vulnerability of information used by employees in call centres (Recommendation 4)
- 13Whether PSPC reviewed its breach notification practices and provided notification of the extent of the Phoenix breaches (Recommendation 5)
- 14Whether PSPC completed the review of pages with row-level security (Recommendation 6)
- Improper disclosure: Complaints well-founded
- Monitoring access: PSPC failed to adequately monitor
- Notification to individuals: PSPC failed to provide timely and sufficient notification
- Addressing vulnerabilities: PSPC failed to fully address known vulnerabilities
- Recommendations: Six recommendations issued to PSPC
- PSPC's proposed actions: Deemed inconsistent or insufficient by OPC
Complaints well-founded
The OPC found that PSPC improperly disclosed personal information of federal employees through the Phoenix Pay System due to systemic vulnerabilities, inadequate testing, coding errors, and insufficient controls, and failed to adequately inform affected individuals.
The Commissioner recommended PSPC develop and implement controls to monitor and document access to personal information, improve testing procedures, conduct necessary risk assessments (PIA/TRA), mitigate call centre vulnerabilities, review breach notification practices, and complete the review of pages with row-level security.
- s.3 Privacy Act
- s.8(1) Privacy Act
- s.8(2) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro