On January 11, Human Resources and Skills Development Canada (HRSDC)
announced that a hard drive containing the personal information about more than half a million clients of the Canada Student Loans Program and 250 departmental employees was missing. The Office of the Privacy Commissioner of Canada, which is investigating the matter, has developed the following information to help those who may have concerns or questions for our office.
What is the Office of the Privacy Commissioner of Canada doing about the loss of an external hard drive from an HRSDC office?
The Office of the Privacy Commissioner of Canada (OPC) has
launched an investigation under the
Privacy Act, the federal public sector privacy law that applies to personal information handling practices of federal departments and agencies.
What will an investigation do for me?
This incident is being investigated under the
Privacy Act, which covers federal departments and agencies. The OPC investigates complaints and, given the Commissioner’s role as an ombudsman, makes recommendations to organizations with respect to their personal information handling practices and seeks to resolve matters on behalf of individuals in Canada. You can expect that the Commissioner will make public her findings in this matter.
Will the investigation result in any compensation for those affected?
The
Privacy Act does not give our Office the ability to fine organizations or seek damages on behalf of individuals.
When will the investigation be complete?
Every case is different, so it’s difficult to predict the exact length of time. Typically, an investigation may take several months. This is an issue we are taking very seriously and we are committed to completing a thorough investigation as quickly as possible.
I’m concerned that I may be one of the individuals impacted by this incident. What should I do?
While this breach touches a large number of Canadians, we understand that not all student loan applicants have been affected. If individuals have not received a notification letter, they could contact HRSDC directly to determine whether their information was on the lost portable hard drive. HRSDC has established a toll-free number at 1-866-885-1866 (or 416-572-1113 for those outside of North America).
I want to complain. How can I do that?
The Commissioner is already investigating this matter on behalf of Canadians and will make her findings public. In the circumstances, individuals do not need to file individual complaints in order to initiate a full investigation into this incident. If, however, you would still like to lodge a formal complaint with us, the first thing you should do is find out if you are one of the individuals affected by this incident (see above). Once you have done this, you can proceed to file your complaint.
How do I file a formal complaint?
If you choose to file a privacy complaint against a federal government institution, you must do so in writing (
download or print a complaint form) or via our
online complaint form on our website. For more information about filing a complaint, see our
complaints web page. You can also call our Office at 1-800-282-1376 if you have questions about our complaints process. There is no charge for filing a complaint with the Office of the Privacy Commissioner of Canada and you are not required to hire special advisors to help you with the process.
Should I be concerned about my personal information being misused?
HRSDC has indicated it has no evidence that personal information has been used to commit fraud to date. However, since officials are unable to locate the hard drive containing the data, individuals may also want to take certain precautions, in addition to steps being taken by the OPC and HRSDC, to better protect themselves from identity theft.
What can I do to protect myself against identity theft and fraud?
If an individual learns that their personal information has been compromised, they may want to takes steps to help protect themselves against identity theft. For example:
- Contact credit card companies, banks, department stores and any other organizations where you have an account to advise them of the loss of your personal information.
- Contact other organizations who supply the identification. For example, if your SIN number has been compromised, contact Service Canada.
- Contact the Canadian credit bureaus – TransUnion and Equifax – to report suspected identity theft and obtain a free copy of your credit report to ensure it is accurate and doesn’t include debts you haven’t incurred.
- Take notes & follow up with the Canadian Anti-Fraud Centre (1-888-495-8501). The CAFC is jointly managed by the RCMP, OPP and the Competition Bureau. They collect information about identity theft and offer advice to victims.
We have a number of resources about identity theft available on our web site. See our “
Identity Theft” topic page for more information.
