Special report to Parliament: Investigation of unauthorized disclosures and modifications of personal information held by Canada Revenue Agency and Employment and Social Development Canada resulting from cyber attacks

1. 1Whether Canada Revenue Agency (CRA) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
2. 2Whether Employment and Social Development Canada (ESDC) contravened section 8 of the Privacy Act by failing to prevent unauthorized disclosure of personal information.
3. 3Whether CRA contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
4. 4Whether ESDC contravened subsection 6(2) of the Privacy Act by failing to take all reasonable steps to ensure the accuracy of personal information.
5. 5Whether CRA and ESDC adequately assessed the level of identity authentication warranted for their online services.
6. 6Whether CRA and ESDC's identity assurance practices adequately protected against identity theft.
7. 7Whether CRA and ESDC's credential assurance practices adequately protected against credential stuffing.
8. 8Whether CRA and ESDC had adequately informed and accountable security decision-making processes.
9. 9Whether interdepartmental information sharing and accountability systems were adequate to protect personal information.
10. 10Whether CRA and ESDC conducted comprehensive vulnerability assessments and penetration testing.
11. 11Whether CRA and ESDC had effective monitoring to detect and promptly contain the ongoing breach.
12. 12Whether other federal departments using the GC Key service experienced fraudulent access or modification of personal information.

• Safeguards (CRA): CRA contravened sections 6(2) and 8 of the Privacy Act due to inadequate safeguards
• Safeguards (ESDC): ESDC contravened sections 6(2) and 8 of the Privacy Act due to inadequate safeguards
• Recommendations (CRA): CRA accepted all recommendations
• Recommendations (ESDC): ESDC accepted recommendations, one conditionally
• Complaint outcome (CRA): Matter concluded as well-founded and conditionally resolved
• Complaint outcome (ESDC): Matter concluded as well-founded and conditionally resolved

The OPC recommended that CRA and ESDC alter their identity assurance practices to align with international standards, adopt multi-factor authentication for account recovery, develop clear processes for sharing threat information and security decision-making, conduct regular internal and external security assessments and penetration testing, and implement effective monitoring plans for quick response to detected attacks.

• s.6(2) Privacy Act
• s.8 Privacy Act
• s.39(1) Privacy Act