Investigation into massive data breach widens to Justice Department by Stephanie Levitz, The Canadian Press, February 25, 2013, The Calgary Herald
A investigation into the federal government’s loss of personal information on over 5,000 Canadians has widened to include the Justice Department. The loss of a portable data key containing information connected to Canada Pension Plan disability benefits was initially thought to involve only Human Resources and Development Canada, which administers the program. But those who filed complaints to the privacy commissioner’s office over the data breach are now being told the incident may have included another department.
“I wish to advise you that it has come to our attention that an employee from the Department of Justice Canada may also have been involved in the incident which resulted in the loss of the USB device,” says the letter. It goes on to inform recipients a complaint against the Justice Department was filed Jan. 28. “Our office is therefore investigating both HRSDC and Justice Canada regarding the incident,” says the letter, dated Feb. 14. A Justice spokeswoman said the department is investigating as well. “Administrative investigations are underway to determine all the facts surrounding this matter,” Carole Saindon said in an email. “The Department of Justice is part of the investigations. Justice Canada takes the protection of privacy seriously,” she said. “It would be inappropriate to comment further while the investigations are ongoing.” The same day as the letter, senior officials from the Human Resources Department were before a House of Commons committee testifying about the breach. No mention was made of the possibility another department was involved.
“We’ve opened a complaint against the Department of Justice in relation to the incident involving loss of the information stored on the USB key — not in relation to the other (student loan info) breach,” Anne-Marie Hayden said in an email. The idea that officials within Justice were looking at people’s medical files raises a host of new questions about what the government does with people’s personal information, said one of the lawyers involved in a class-action lawsuit against the government. “Nothing good comes of having the Department of Justice look at your CPP disability pension application information,” said Ted Charney. Charney said the possibility another department is involved could change the nature of the lawsuit. “If it turns out that this personal information has been leaked to a department who shouldn’t have received it, it’s an additional breach of privacy,” he said. “The motives and purpose for that employee getting access to that information is of very significant concern to us.”
“The incidents are unacceptable,” Ian Shugart, the department’s deputy minister told the committee earlier this month. “Sensitive personal information was stored on unencrypted portable storage devices and not properly secured. This should not have occurred.” [Emphasis added]