Canadian privacy & access decisions

A B.C. woman received a package from the Canada Revenue Agency (CRA) containing her deceased daughter's tax information along with the confidential personal information of five other individuals. She attempted to report the data breach and return the misdirected information to the CRA through various channels, including phone calls and an in-person visit to a tax centre, but faced significant difficulties. Only after she contacted a CBC news reporter did the CRA take prompt action to retrieve the misdirected records. The OPC launched a Commissioner-initiated complaint and found that the CRA had breached the privacy rights of the taxpayers involved. The CRA committed to and implemented remedial measures to prevent similar incidents and improve its internal procedures for client service and misdirected mail.

• Whether the Canada Revenue Agency breached the privacy rights of taxpayers by mistakenly sending confidential personal information to an unauthorized individual
• Whether the Canada Revenue Agency's procedures for handling misdirected mail and breach reporting were adequate
• Whether the Canada Revenue Agency's client service channels were accessible for reporting privacy breaches

This report details an investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants from an ESDC office. The USB key, which was neither password-protected nor encrypted, contained sensitive data including SINs, medical conditions, and dates of birth. The investigation found weaknesses in physical, technological, administrative, and personnel controls at both ESDC and Justice Canada, as a Justice Canada lawyer had custody of the key when it went missing. The OPC concluded that both departments failed to translate their privacy and security policies into meaningful business practices. Both ESDC and Justice Canada accepted nine recommendations from the OPC to improve their protection of personal information.

• Whether Employment and Social Development Canada (ESDC) adequately protected personal information on a lost USB key
• Whether Justice Canada adequately protected personal information on a lost USB key while in its custody
• Whether physical controls for personal information were adequate
• Whether technological controls (encryption, password protection) for personal information were adequate
• Whether administrative controls for personal information were adequate
• Whether personnel controls for personal information were adequate
• Whether ESDC translated its privacy and security policies into meaningful business practices
• Whether Justice Canada translated its privacy and security policies into meaningful business practices

The Information Commissioner initiated a systemic investigation under section 39 of the Access to Information Act into Public Works and Government Services Canada (PWGSC). The investigation focused on the processing of eight access to information or consultation requests received by PWGSC between July 22, 2008, and January 19, 2010. The primary concern was the possibility of interference in the processing of these requests. This report, titled "Interference with Access to Information: Part 2," details the Commissioner's findings regarding the alleged interference. The investigation aimed to determine if the institution's handling of these requests was appropriate or if there were instances of improper influence or obstruction.

• Whether there was interference in the processing of access to information requests at Public Works and Government Services Canada
• Whether Public Works and Government Services Canada properly processed eight specific access to information or consultation requests

The Office of the Privacy Commissioner of Canada (OPC) initiated a complaint against Employment and Social Development Canada (ESDC) following the loss of an unencrypted external hard drive containing the personal information of 583,000 Canada student loan borrowers and 250 ESDC employees. The investigation found that ESDC failed to implement adequate physical, technical, administrative, and personnel security controls, leading to contraventions of sections 6(3), 7, or 8 of the Privacy Act. The lost data included highly sensitive details such as Social Insurance Numbers, names, addresses, dates of birth, and comprehensive student loan financial information. While ESDC took extensive mitigation steps post-incident, including public notification and credit protection offers, the OPC concluded the complaint was well-founded due to the systemic failures in safeguarding personal information. ESDC accepted all ten of the OPC's recommendations aimed at improving its privacy management framework, and was well-advanced in their implementation. The OPC will conduct a follow-up review in one year to confirm full implementation.

• Whether ESDC failed to implement adequate physical security controls for personal information stored on portable media.
• Whether ESDC failed to implement adequate technical security controls, such as encryption and risk assessments, for personal information on portable media.
• Whether ESDC failed to implement adequate administrative controls, including asset inventory, information classification, and lifecycle management, for personal information.
• Whether ESDC failed to implement adequate personnel security controls, such as employee training, awareness, and accountability, regarding personal information.
• Whether ESDC contravened subsection 6(3) of the Privacy Act by failing to properly dispose of personal information.
• Whether ESDC contravened section 7 of the Privacy Act regarding the use of personal information.
• Whether ESDC contravened section 8 of the Privacy Act regarding the disclosure of personal information.
• Whether the delay in notifying affected individuals of the breach was reasonable.
• Whether the scope of personal information reported to affected individuals in the notification letters was complete.