Custodian of Social Insurance Numbers loses list of them
A woman complained to us about the mishandling of her personal information at an information session for employment insurance (EI) claimants. Human Resources and Skills Development Canada (HRSDC) holds these mandatory information sessions primarily to validate the identity of EI claimants, who generally apply for the benefit online, without face-to-face contact.
At the end of the session, the complainant learned that the attendance sheet had gone missing. She was told it contained the names, telephone numbers and Social Insurance Numbers (SINs) of the session’s 32 participants.
Departmental officials prepared a report and advised their access-to-information and privacy office, as well as our Office, about the incident. They also notified all affected individuals, apologized, and directed them to information on protecting themselves from identity theft.
Upon investigation, we agreed that the Department had not properly safeguarded the personal information printed on the sheet. We upheld the complaint as well founded.
We were especially disturbed that the breach involved the SIN, which is a critically important piece of personal information for people dealing with federal and other institutions. Because of its value, the number is highly vulnerable to misuse if it falls into the hands of identity thieves.
Worse, the breach was the fault of HRSDC, the very Department that issues and manages the use of the SIN.
Still, we noted that officials in the region where the incident occurred had taken all reasonable steps to mitigate any consequences from the data breach and to prevent a recurrence.
Among other things, they directed officials to fully black out the SINs on attendance sheets before the documents are used at EI claimant information sessions, a practice that is expected to be adopted across the country.
- Date modified: