The loss of a portable hard drive containing the personal information of more than half a million people has raised privacy questions and prompted a lawsuit against the government agency responsible. Human Resources and Skills Development Canada announced recently that it had lost the device, which contained data on 583,000 Canada Student Loans Program borrowers from 2000 to 2006. Even as authorities investigate the incident, agencies are being mandated to take data protection measures and onlookers are calling for more oversight.

No banking or medical information was on the device, according to agency officials. However, the missing files include student names, social insurance numbers, dates of birth, contact information and loan balances of borrowers, as well the personal contact information for 250 department employees. According to Bob Buckingham, a St. John’s lawyer who filed a class-action lawsuit on behalf of those affected, the loss could have an effect on as many as 2 million people or more, due to the inclusion of family data in borrowers’ files. Borrowers from Quebec, Nunavut and the Northwest Territories are not affected, however.

“I want all Canadians to know that I have expressed my disappointment to departmental officials at this unacceptable and avoidable incident in handling Canadians’ personal information,” Human Resources Minister Diane Finley said, noting that she has called on the RCMP to help with the incident.

Addressing data loss

The breach came to light during an investigation of the loss of a USB drive containing the personal information of more than 5,000 Canadians. In light of these two incidents, Finley directed government officials to receive information and training on a new security policy that bans portable hard drives within the department. Additionally, all portable devices will be assessed for the risk they pose, and only approved USB keys will be permitted to connect to the agency network. New disciplinary measures will be applicable to those responsible for such losses in the future.

Letters are being sent to all those affected and a hotline has been set up to handle questions. The government is also offering all affected people a free credit check, and citizens can ask that their social insurance number be flagged in the event of unusual activity. However, the incident has continued to raise questions for some.

“It highlights how easy it is for information in today’s age to be misplaced, to be misappropriated, to be stolen – if that’s what the case was,” said Adam Awad, national chairman of the Canadian Federation of Students, according to CTV News.

Organizations concerned about handling a similar data loss incident may want to rethink their storage management policies. Moving to a cloud computing solution might reduce the risk associated with a lost end user device, for instance. By working with a managed services provider to determine a custom enterprise storage plan, organizations can anticipate and mitigate the damage of a potential data loss event.

')}