The Department of Justice is under investigation in connection with a lost USB key containing the personal information of thousands of pension plan applicants.
In December, 2012, Human Resources and Skills Development Canada said a misplaced USB key meant that personal information of about 5,000 Canadian Pension Plan applicants had been lost. The following month, HRSDC announced a different misplaced USB key had lost the personal information of more than half a million Canada Student Loans Program recipients.
The first data breach included applications for pensions, old age security benefits, employment insurance and child care tax credits.
“It has come to our attention that an employee from the Department of Justice Canada may also have been involved in the loss of the USB device,” reads a letter from an investigator in the office of Privacy Commissioner Jennifer Stoddart to one of those affected by the breach. “Our office is therefore investigating both HRSDC and Justice Canada regarding this incident.”
In an email, Privacy Commissioner spokeswoman Anne-Marie Hayden confirmed that the office is looking into the possible involvement of a Department of Justice Canada employee. “Our office is contacting those who have already filed an official complaint against HRSDC in relation to the USB key incident to seek their consent to an amendment of their complaint to include both HRSDC and Justice Canada as respondents.”
“Administrative investigations are underway to determine all the facts surrounding this matter. The Department of Justice is part of the investigations,” wrote a Department of Justice Canada spokesperson in an email. She declined to comment on specific details, writing that, “It would be inappropriate to comment further while the investigations are ongoing.”
Ted Charney, senior partner at Falconer Charney LLP, one of the law firms involved in the class action lawsuit on behalf of CPP applicants whose information was lost, finds it disconcerting that CPP information may have been shared with the Department of Justice Canada.
“I don’t know how somebody’s confidential health information to apply for a CPP disability pension ends up in front of employees with the Department of Justice,” he said. “I don’t know if somebody when they applied for a CPP disability pension ever realized that the government intends to show that information to other departments, including the DOJ.”
Charney said that nearly all of the 5,000 people affected by the first data breach have registered with the class action lawsuit. “To the extent that the class members are additionally harmed because of the Department of Justice investigation, it could expand the nature of the claim. It certainly expands the nature of our inquiry into what’s been going on federally in terms of protecting information and how it’s exchanged between various departments.”
The second external hard drive, which went missing from an HRSDC office in Gatineau, Que., contained social insurance numbers, names, birth dates, addresses and loan balances of hundreds of thousands of students or former students. HRSDC originally said only those who took out loans between 2000 and 2006 were affected. But people have come forward who took out loans more recently than that, indicating the pool of people affected may be larger than HRSDC claims.
The department did not respond to repeated requests for comment on this discrepancy, but an update on its website admits that 2,800 individuals affected fall outside the original window. “Efforts continue to locate current contact information for all affected borrowers.”
HRSDC has said multiple times there is no evidence any of that personal information “has been accessed or used for fraudulent purposes.” It has engaged the services of credit rating agency Equifax to flag the credit files of those affected and monitor them for any potentially fraudulent activity over the next six years.
In addition to complaints filed with Canada’s Privacy Commissioner, many of those affected have launched a $600-million class action suit, involving lawyers from multiple firms across the country. Charney has said that number could grow substantially if there’s any evidence of identity theft resulting from the breach.
Correction: A previous version of this article conflated two distinct data breaches on the part of Human Resources and Skills Development Canada. The Privacy Commissioner’s investigation of the Department of Justice applies to the loss of Canadian Pension Plan applicants’ personal information.
Comments