DATA PRIVACY

Syllabus

Module 1:

 An overview of privacy laws in Canada

1. Case Study: Student loans data breach (Canada) - A breach involving the personal information of about more
than half a million clients of Human Resources and Skills Development Canada (HRSDC) and 250 departmental
employees

In this lesson you will learn about:

 A breach involving the personal information of about more than half a million clients of Human Resources and
Skills Development Canada (HRSDC) and 250 departmental employees.

Parties involved:

 Individuals who applied for and who received student loans through the Canada Student Loans Program during
the period from 2002 to 2006.

 Employment and Social Development Canada - ESDC (formerly Human Resources and Skills Development
Canada - HRSDC)

Incident:
Breach involving the personal information of about more than half a million clients of Human Resources and
Skills Development Canada (HRSDC) and 250 departmental employees.

Date:
November 2012

Summary:
In October 2012, an employee of ESDC’s Canada Student Loans Program (CSLP) used a department-owned, 1
terabyte hard drive to make a backup copy of the program information stored in the central computer, as a
risk mitigation measure to protect against an accidental loss or deletion of the files during a data migration
work scheduled for the Department's network.

The hard drive was stored in a lockable filing cabinet located in the employee’s cubicle, in an envelope, hidden
under suspended files. On November 5, 2012, the employee went to retrieve the external hard drive from the
filing cabinet and noticed that it was missing. The Department was unable to locate the hard drive or
determine whether human error or malicious intent was responsible.

On December 17, 2012, ESDC verbally notified the Office of the Privacy Commissioner of Canada (OPC) of the
loss of an external hard drive containing the personal information of over half a million Canada student loan
borrowers, and 250 ESDC employees, followed by a formal written notification on January 7, 2013.