Privacy breach affects Islanders

Ryan Ross
Send to a friend

Send this article to a friend.

Lost hard drive contains personal information for more than 4,500 people on P.E.I.

An HRDC office has lost an external hard drive containing personal information for some Canada Student Loan borrowers.

A major privacy breach has left some Islanders wondering what to do after a Human Resources and Skills Development Canada office lost an external hard drive containing personal information for 583,000 Canada Student Loan borrowers.

Amanda Thoy is one of those borrowers and said she first heard about the privacy breach Friday through a friend but didn’t follow up on it right away.

“Initially, you think the government won’t lose your information so I kind of thought it’s probably nothing major and I honestly didn’t think I’d be one of them,” she said.

But Thoy soon learned she was wrong when she called a number HRSDC provided on Monday.

She was on the list but said she didn’t get any help from the person she spoke to.

“I got the runaround.”

HRSDC first learned of the privacy breach in November after reviewing another incident involving a lost USB key that contained the personal information of more than 5,000 people.

It was during that review that the department discovered a backup external hard drive containing personal information for Canada Student Loan borrowers from 2000-2006 was lost at an HRSDC office in Gatineau, Que.

That includes information for more than 4,500 people who live in P.E.I.

The information on the hard drive included borrowers’ names, dates of birth, Social Insurance Numbers, addresses and student loan balances.

No information for borrowers from Quebec, Nunavut and the Northwest Territories was on the hard drive because those jurisdictions have their own programs.

HRSDC said it will only be sending letters to people affected for whom the department has current contact information to advise them of the privacy breach and what steps to take to protect themselves.

The government also provided a phone number for people to call to see if they were affected.

Thoy called but said she didn’t get much help.

Instead, she was given a scripted response and had to ask twice before the representative told her she was one of the people affected, she said.

Timeline of events provided by Human Resources and Skills Development: • Nov. 5, 2012: Search efforts began after an HRSDC employee discovered an external hard drive was missing. • Nov. 28, 2012: HRSDC’s departmental security officer was notified. • Dec. 6, 2012: Discovery that personal information of Canada Student Loans Program clients was on the hard drive. • Dec. 14, 2012: The Office of the Privacy Commissioner was notified. • Jan. 7: The incident was referred to the Royal Canadian Mounted Police. • Jan. 11: Canadian public was informed of the incident.

Thoy said the government has forced people to become reactive instead of proactive when it comes to protecting their personal information.

Autumn Getson is another Island resident whose information was lost and said it was unnerving at a time when people are concerned about identity theft.

“Who knows where this information is and what it’s going to be used for,” she said.

In a statement, Human Resources and Skills Development Minister Diane Finley, said she has directed departmental officials to take immediate action to make sure a situation like the missing hard drive never happens again.

“I want all Canadians to know that I have expressed my disappointment to departmental officials at this unacceptable and avoidable incident in handling Canadians’ personal information,” she said.

Finley also said the department is continuing its investigation and has contacted both the Office of the Privacy Commissioner and the RCMP.

The department is implementing new protocols since the incident and portable hard drives will no longer be allowed.

All departmental employees will have to take training on the proper handling of sensitive information and new disciplinary measures will be implemented, up to and including firing anyone who doesn’t follow the new guidelines.

In the meantime, Thoy has set up a Facebook group for people to get together and talk about how to protect themselves, which is information she said the government should have given out.

“We shouldn’t be thrown out to the wolves to figure out how to fix it,” she said.

Anyone who has been affected and needs to provide HRSDC current contact information to receive a letter can do so at 1-866-885-1866 between 8 a.m and 8 p.m.

Organizations: Human Resources

  • 1
  • 2
  • 3
  • 4
  • 5

Thanks for voting!

Top of page

Comments

Comments

Recent comments

  • Bill Kays
    Bill Kays
    January 16, 2013 - 17:20

    Nobody in government is accountable and that is why no one ever loses their jobs over this crap. Why can we not go back to firing people for poor performance or no performance. We can, so why do we not, prosecute government officials for wrong doing, it never happens anymore. There is no accountability in government anymore and this is why people are getting frustrated. We are accountable for our actions but government is not.

  • Tired of working so others can mess it up
    January 16, 2013 - 15:49

    I'm not doing any thing ...I'm not phoning any credit card companies or credit organizations...If someone steals and misuses my personal information I'm going to sue and if that doesn't work I will do everything I possibly can to wreak havoc on the financial system...run up whats left of my credit after the thieves have had their way with it...borrow.. take everything I can out of the canadian banking system and forefit on the works... i have spent the past 35 years of my life following the rules scrimping and saving, working eveyday watching my youth pass away in a cube .. helping to drive the canadian economy forward...i expect all canadians, especially the gov. to act in a similar manner. If I make a mistake the government holds me responsible...from taxes to criminal offences, I lose my job if I am incompotent at work...I'm doing the same thing...HRSDC you call the credit card comapny and organizations on my behalf, you clean it up.. Heads should roll and if the tax payers have to pick up the pieces they should be angry and speak out about it...but direct it where the problem origionated, don't tell me the people impacted not to sue, tell HRSDC to suck it up, cut the cost out of hrsdc's budget and fire the director. This is a big deal...that hard drive was taken with an intent...

  • Unfortunate
    January 16, 2013 - 14:58

    @ Amanda Thoy; What is the facebook group? I can't seem to find one.

    • amanda thoy
      January 16, 2013 - 16:46

      @unfortunate, the name of the group is exactly as i wrote it below, I am not sure what else to recommend..possibly try parts of the name, or post on your page for someone to add you to the group. There are over 500 islanders on the group now that have been referring others so maybe a friend of yours may be one of them.

  • Update From Website
    January 16, 2013 - 14:02

    I found this on their website.... Backgrounder In late 2012, the department of Human Resources and Skills Development Canada (HRSDC) informed the Office of the Privacy Commissioner of the loss of a USB key, which contained the personal information of over 5,000 Canadians. While reviewing this incident, departmental officials learned of a subsequent serious loss of Canadians’ personal information. Although the search is ongoing, an external hard drive has been deemed lost from an HRSDC office in Gatineau, Quebec. The Department is continuing its investigation. The Office of the Privacy Commissioner has been consulted. The office of the Minister has engaged the Royal Canadian Mounted Police on this matter, given its serious nature. Details regarding loss of the hard drive A hard drive containing personal information on 583,000 Canada Student Loans borrowers dated from 2000-2006 has been deemed lost at an HSRDC office in Gatineau, Quebec, although the search is ongoing. The file contained information including student names, dates of birth, Social Insurance Numbers, addresses and student loan balances from recipients across the country (except Quebec, Nunavut and the Northwest Territories as they manage their own student loan programs). Personal contact information of 250 HRSDC employees was also on the hard drive. No banking or medical information was included on the drive. The client information was saved onto an external hard drive as a back-up storage option. Timeline of events November 5, 2012: A HRSDC employee discovered that an external hard drive was missing. Search efforts began. November 28: The Departmental Security Officer was notified. December 6: Discovery that personal information of Canada Student Loans Program clients was on the hard drive. December 14: The Office of the Privacy Commissioner was notified. January 7: The incident was referred to the Royal Canadian Mounted Police. January 11: Canadian public was informed of the incident. Process for inquiries and more information HRSDC is sending letters to individuals affected, for whom we have current contact information, to advise them of the incident and what steps to take to help protect their personal information. A toll-free number has been set-up at 1-866-885-1866 (or 416-572-1113 for those outside of North America) for individuals to verify if they are affected by this incident, and to ask additional questions regarding this issue. Hours of operation will be 8:00 a.m.-8:00 p.m. (EST), 7 days a week, starting Monday, January 14, 2013, for as long as needed. People with a hearing or speech impairment and using a teletypewriter (TTY) can call 1-800-263-5883. Hours of operation will be 8:00 a.m. -8:00 p.m. (EST), 7 days a week, starting Monday, January 14, 2013, for as long as needed. All details on this incident and how Canadians can protect their personal information are available at http://www.canlearn.ca/eng/main/spotlighton/privacy/index.shtml New HRSDC policy for storing secure information The Minister has directed that the overall policy for security and storage of personal information at HRSDC be strengthened and improved. The highlights are: New, stricter protocols to be implemented immediately. Portable hard drives are no longer permitted. Unapproved USB keys are not to be connected to the network; Immediate risk assessments of all portable security devices used in the Department’s work environment to ensure that appropriate safeguards are in place; these assessments will continue on a regular, ongoing basis; Mandatory training for all employees regarding the proper handling of sensitive information, including personal information; Implement new data loss prevention technology, which can be configured to control or prevent the transfer of sensitive information; Disciplinary measures that will be implemented for staff, up to and including termination, should the strict codes of privacy and security not be followed.

  • Autumn
    January 16, 2013 - 11:22

    My information was contained on that hard drive. Makes me sick to think of the different ways that information could be used. I wasted a lot of time yesterday on hold trying to "flag" all important areas. How is this "Flagging" going to affect things like travel, and big purchases. I see more wasted time in the near future. There is a call centre, but that is outsources, so I was unable to get any information. I called National Student Loan directly, and she told me it was a copy of the permanent record, they still have my information and she ensured that my banking information was not released. At this time it is considered "lost" therefore no further information other than the investigation is ongoing.

  • Abby
    January 16, 2013 - 10:13

    Why does it take something like this to happen before a government agency has the proper security measures in place? I am one of those affected by this "gross negligence" and now like so many others, I have to take measures to protect my identity. This is information I trusted the government with. Minister Finley...too little too late. Over half a million people Canada wide are now faced with the prospect that their information could be used illegally. No matter how dilgent I was to make sure my information was never "out there" look what happens? Shot in the foot by HRDC. All we get is a half a$$ed apology and a letter with instructions on how to clean up their mess.

  • Pro Bono
    January 16, 2013 - 10:05

    I think an Island Lawyer should be offering his/her services at a discounted rate for each islander effected and start a law suit. This is pertinant information that may get used years down the road and effect each of those whose SIN numbers were lost. Someone needs to be accountable. Have the lawyers wages included in the compensation sought if case wins.

    • taxpayer
      January 16, 2013 - 10:43

      Yes, and if they win, then you and I and everyone else ends up paying more taxes. Brilliant strategy you idiot.

    • voter
      January 16, 2013 - 14:52

      of course there should be legal reprecussions for this and law suits will be filed --ignorant to say otherwise -- these people have been put in danger and the culprits are the people of Canada's representatives /employees --

  • Jim JImmerson
    January 16, 2013 - 09:53

    This is why the government had no idea what's going on and can't keep people's information updated from on representative to the next; because there are 30,000 external hard drives and if you call a center in NL they don't have yours there, it's in BC.

  • Marie
    January 16, 2013 - 09:46

    What is with all the incompetence in offices that collect our personal data??? CIBC info in California,CRA Gatineau looses business information; Toronto looses voters list; HRSDC looses student loan info. Sounds like incompetence to me...putting personal info at risk. And didn't they first say that no important personal info was lost...what the heck is date of birth, SIN and home address if not personal enough for identity theft??? Tighten the info flow folks!!!

  • don
    January 16, 2013 - 09:46

    Diane Finley. should be fired and the ones who loses these items be fired also as they are careless idiots.

    • amanda thoy
      January 16, 2013 - 12:36

      please join the facebook group "student loan borrowers affected by the hrsdc privacy breach" ONLY if you have been affected - there is information on there about what you can do to protect your financial identity and there is links to the NFLD law firm that has started a class action suit.