This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact The Epoch Times Reprints.
Privacy Commissioner of Canada Philippe Dufresne waits to appear at the Standing Committee on Access to Information, Privacy and Ethics in Ottawa on Nov. 19, 2024. The Canadian Press/Patrick Doyle
The RCMP lost a memory key containing the personal details of victims, witnesses, and informants, and later discovered criminals were attempting to sell it, Canada’s privacy watchdog says.
The RCMP reported the breach to the Office of the Privacy Commissioner of Canada (OPC) in March 2022, prompting an extensive investigation, according to a newly released report from Commissioner Philippe Dufresne.
The investigation found the unencrypted USB storage device held the personal data of 1,741 individuals, which included witnesses, complainants, subjects of interest, and informants, as well as police personnel and civilian staff.
“The RCMP’s investigation also established that only some of the documents on the device were password protected and that the device itself was not encrypted nor password protected,” the report reads.
“Information on the device was highly sensitive … and it was found circulating in the criminal community. This creates a higher risk that individuals could be seriously harmed.”
The storage device contained personal information such as names, biographical details, citizenship status, contact information, criminal history, dates and locations of birth and death, employee identification numbers, physical characteristics, and signatures. It also included photographs and videos.
An RCMP detachment was informed by a confidential source three weeks following the loss that members of the criminal community were attempting to sell the data contained on the device, the report said.
“Given the nature and sensitivity of the information that the RCMP handles on a daily basis, the OPC would have expected the RCMP to have strict security measures in place to safeguard its information holdings,” the privacy commissioner’s report says.
“We also would have expected for those measures to be stringently monitored and that the RCMP would take prompt action where non-compliance, whether accidental or not, is discovered.”
The commissioner concluded that the RCMP did not implement suitable actions to protect personal information, resulting in a violation of the Privacy Act because the information was disclosed without the consent of the individuals.
The Mounties accepted the recommendations in principle but did not agree to implement them within a specified timeframe, the commissioner said.
Dufresne’s office also determined that RCMP personnel did not promptly report the loss of the USB storage device to the force’s authorities.
Upon becoming aware of the breach, the RCMP’s communication to those affected and the measures implemented to mitigate the risk of further harm to them were deemed “generally appropriate in the circumstance” by the commissioner.
The commissioner advised the RCMP to implement stringent security protocols for the use of USB storage devices, considering the delicate nature of the personal data that law enforcement manages on a daily basis. These protocols included ensuring the use of sanctioned USB devices, as well as audits to ascertain that devices are returned when they are no longer necessary.
RCMP spokeswoman Robin Percival said the federal policing agency took the breach seriously, launching a full investigation into the incident to determine whose identities were breached.
“A dedicated team was convened to complete a risk assessment to identify the level of risk associated with each individual impacted by the breach and notified those individuals by phone, letters or in person based on the level of impact,” she said in an emailed statement.
The force also initiated a review of its security and privacy policies, along with its awareness program, to ensure employees were “reminded” of and “sensitized” to their ongoing responsibilities to safeguard sensitive information.
“The program also addresses the immediate actions to be taken in case of a security breach,” Percival said.
She said the RCMP is committed to preventing the use of unauthorized devices and is currently implementing measures to minimize the use of USB storage sticks.
