Government agency loses more than 500,000 students' personal information
Data leak discovered during investigation into smaller breach of 5,000 Canadians' information
An external hard drive holding the personal information of Canadians who borrowed money through the Canada Student Loans Program (CSLP) has been lost from their Gatineau, Quebec offices Human Resources and Skills Development Canada (HRSDC) announced through a press release posted to canlearn.ca.
According to the release, the external hard drive has been missing since Nov. 5, 2012 and affects 583,000 former CSLP clients from 2000-2006. The information stored on the hard drive included names, dates of birth, Social Insurance Numbers, addresses, and student loan balances. Personal information of 250 HRSDC employees was also on the device.
The hard drive was discovered to be missing during an incident review of the loss of a USB key containing the personal information of 5,000 students. Though it was reported missing Nov. 5, the contents of the missing hard drive were not discovered until Dec. 6. The incident was not reported to the Office of the Privacy Commissioner until Dec. 14, and it was not released to the public until Friday, Jan. 11. The RCMP is now investigating the incident with the assistance of all related government authorities.
“I want all Canadians to know that I have expressed my disappointment to departmental officials at this unacceptable and avoidable incident in handling Canadians’ personal information,” Diane Finley, minister of human resources and skills development, stated in a press release.
“As a result, I have directed that departmental officials take a number of immediate actions to ensure that such an unnecessary situation does not happen again."
The administration at the University of Waterloo has been directing possibly affected alumni and students towards the HRSDC hotline set up by the federal ministry. The hotline number, provided in the press release, was not in operation until Jan. 14 — with HRSDC offices remaining closed over the weekend. UW did not receive any advanced communication about the breach.
“Any leak of this nature is extremely serious,” registrar Ken Lavigne said. “It involves sensitive information about people’s financial status ... The federal government and any agency, including us, will attempt to protect the privacy of our constituents.”
University of Waterloo’s Federation of Students (Feds) in an email response to Imprint about the data leak, said that, to date, no current or former students have contacted Feds. The Canadian Alliance of Student Associations (CASA) sent members an electronic notice on Jan. 11. HRSDC has not contacted Feds.
“I cannot speak specifically to the potential implications for a student whose information was among those lost,” Adam Garcia, Feds vice-president of education, said.
Adam Awad, head of the Canadian Federation of Students’ (CFS), also issued a statement to Imprint via e-mail. Awad said that students have contacted CFS over the breach and stated that they have reassured students that they are working to find a solution.
“We met with Canada Student Loans Program staff to discuss the privacy breach and what steps they’ve taken,” Awad said. “We’re reassured that they’ve involved both the Privacy Commissioner and the RCMP and have contacted the office that is responsible for Social Insurance Numbers so that they can monitor all of the numbers that were contained on the drive for any suspicious activity.”
HRSDC has stated that they intend to send out letters with information necessary to help protect the personal information of the individuals who may be affected. But former students who used the program are not happy about the incident, to say the least.
“The Canadian government treats recipients of student loans like second class citizens,” said Anne Thérlaut, a former student at Dalhousie University from 2001–2003. “The fact that it took them months — plural — to announce the loss of this data is proof of that.”
“Education, even post-secondary education, should be the right of every citizen of this country and we shouldn’t be forced to jump through hoops, go heavily into debt, and risk identity theft in order to be able to gain marketable skills.”
CSLP is a national program that has clients across the country and works with provincial loan programs such as the Ontario Student Assistance Program. “The minister has directed that the overall policy for security and storage of personal information at HRSDC be strengthened and improved,” stated the HRSDC in their Friday press release.
Despite HRSDC’s decision to go in a new direction with security policy, some Canadians are skeptical of the government’s ability to protect their information.
“I think anyone would find it rather unnerving that something like this could happen within a government department,” said Ryan Connell, a former student at Conestoga College from 2002-2005.
“I also think the lack of information of how something like this could happen makes me wonder if this is something that can just easily happen again and why there weren’t safeguards in place from the start.”
— With files from Elizabeth Bate, Gabriela Grant, Ron Kielstra, Michelle Sterba, and Caz Spidell
Concerned individuals can contact HRSDC by calling 1-866-885-1866 starting on Monday, January 14. The line will be available every day between 8:00 a.m. and 8:00 p.m. (EST).
More information can be found at http://www.news.gc.ca/web/article-eng.do?mthd=tp&crtr.page=1&nid=714639&crtr.tp1D=4
This story has been updated from its original version.