Privacy commissioner raps B.C. for massive privacy protection failure

VICTORIA -- British Columbia's Education Ministry lost personal information pertaining to 3.4 million students when staff breached security policies and misplaced a hard drive with data stretching back 30 years, an investigation has revealed.

See Full Article

Privacy commissioner Elizabeth Denham said in a report released Thursday that the ministry did not secure a portable hard drive when the information was transferred from computer servers in an effort to save on storage costs.

A series of actions put the information at risk, assistant commissioner Jay Fedorak said.

"The policies were good and it appeared that the employees were aware of the policies," he said in an interview. "They just didn't follow them."

"Policy is important, but policy alone isn't enough," Fedorak said. "It's important that there be adequate and effective training of staff and some compliance auditing or follow-up."

The lost information collected between 1986 and 2009 was mostly associated with students in British Columbia and Yukon.

It included names, addresses, dates of birth, gender, grades, schools, personal education numbers, graduation status, financial aid data and designations such as ESL or special needs.

A smaller number of records included more sensitive information, such as teacher retirement plans, education outcomes for student cancer survivors, health and behaviour issues and children in care.

The ministry discovered the drive missing last August, when a team of up to 50 bureaucrats began searching, to no avail. The Office of the Information and Privacy Commission was notified in September.

"They satisfied us they had looked in every box, in every desk, in every drawer, and they weren't able to find it," Fedorak said.

Investigators said the device could have been missing for as long as five years. After moving information off the server, staff failed to encrypt the device. Then they transferred it to a warehouse that wasn't equipped to secure information or keep track of devices for retrieval.

Denham made nine recommendations to strengthen the security of personal information, including encrypting all mobile data storage devices and maintaining accurate inventories of personal information.

"If this was actually a situation involving a cash loss of $3.4 million, I believe the government would take rapid, dramatic and decisive action to deal with the situation," she said in her report.

Education Minister Mike Bernier acknowledged the privacy breach as "unacceptable" and described the commissioner's assessment and recommendations as "fair and balanced."

"We sincerely apologize for any inconvenience this incident may have caused people," he said in a statement.

Bernier also said the government must do a better job of ensuring that public servants receive ongoing training. He said a formal review of the ministry's personal information management practices is underway.

Enhanced privacy policies will be introduced in the coming weeks, he said.

But Opposition New Democrat education critic Rob Fleming said he's not convinced the government's actions will fix deeply rooted privacy problems. He pointed to other breaches that have occurred in the health and forests ministries.

"(This is) bad decision making in a crisis-like environment, I think, created by B.C. Liberals cuts in the Ministry of Education and elsewhere."

The commission will follow up in three months to determine the extent to which the ministry has implemented the recommendations. It will also conduct an audit of privacy training.



Advertisements

Latest Canada & World News

  • Activists rip Kim Jong Un's photo in Olympic protest

    World News CTV News
    SEOUL, Korea, Republic Of - Anti-Pyongyang activists on Wednesday ripped photos of North Korean leader Kim Jong Un in the latest protests in Seoul against South Korea's outreach to North Korea over next month's Pyeongchang Winter Olympics. Source
  • D.C. sniper requests hearing to ask for lower sentence

    World News CTV News
    RICHMOND, Va. - A sniper who randomly killed 10 people and terrorized the Washington, D.C., region more than 15 years ago is entitled to a new hearing to ask for a lighter sentence, his lawyer argued Tuesday to a federal appeals court. Source
  • Skepticism, worry amid preparation for Rohingya repatriation

    World News CTV News
    YANGON, Myanmar -- Myanmar says it's ready for a gradual repatriation of Muslim Rohingya refugees chased out by the Buddhist-majority country's military. Bangladesh says it's preparing for the transfer, but it might need more time. Source
  • Philippine volcano spreads lava almost three kilometres from crater

    World News CTV News
    LEGAZPI, Philippines -- Lava fountaining regularly from the Philippines' most active volcano has flowed up to 3 kilometres (1.86 miles) from the crater in a dazzling but increasingly dangerous eruption. Mount Mayon has spewed lava up to 600 metres (2,000 feet) high at times Tuesday and early Wednesday and its ash plumes stretched up to 5 kilometres (3 miles) above the crater. Source
  • 'So glad that you're here': MMIW inquiry begins in Yellowknife

    Canada News CTV News
    After a year of struggles, the National Inquiry into Missing and Murdered Indigenous Women and Girls resumed Tuesday in Yellowknife, Northwest Territories. “I’m so glad that you’re here,” Dean Meyer, whose daughter went missing in 2010, said on the first of three days of hearings. Source
  • Conservative MP Kellie Leitch won't run in 2019

    Canada News CBC News
    Conservative MP Kellie Leitch will not seek re-election in 2019, CBC News has confirmed. Leitch, who represents the Ontario riding of Simcoe–Grey, made a failed bid for the party's leadership last year. More to come Source
  • Girl tortured with siblings was bullied, frail: classmate

    World News CTV News
    LOS ANGELES -- The oldest of the 13 California siblings who authorities said were imprisoned by their parents was frail, smelly and picked on as a grade school student in Texas, one of her classmates said in a heart-wrenching Facebook post. Source
  • Oklahoma gas rig workers' remains recovered day after explosion

    World News CBC News
    Officials on Tuesday recovered the remains of five gas rig workers who had been missing since a fiery explosion in eastern Oklahoma a day earlier. Pittsburg County Sheriff Chris Morris said once the natural gas drilling rig was stabilized following the blast and subsequent fires, employees from the state medical examiner's office went into the wreckage and recovered the bodies in about two hours. Source
  • Calgary skydiver killed in Southern California roof crash

    Canada News CTV News
    PERRIS, Calif. -- Authorities have identified a skydiver who died when he fell onto the roof of a home in Southern California. The Riverside County coroner's bureau says the man who died Monday afternoon was Aime-Jean St. Source
  • Gay couple sues U.S. government for denying citizenship to one of their twins

    World News CTV News
    LOS ANGELES -- Ethan and Aiden Dvash-Banks are toddler twins who share almost everything: the same toys, the same nursery, the clothes and the same parents. Everything but a toothbrush and U.S. citizenship. To remedy what their parents, a gay married couple, view as an injustice, Ethan Dvash-Banks became a plaintiff at the tender age of 16 months in a federal lawsuit against the U.S. Source