An external hard drive containing the personal and financial information of 583,000 Canada Student Loan borrowers went missing from a Human Resources and Skills Development Canada (HRSDC) office last year, the department announced Friday. The portable hard drive contains the names, dates of birth, addresses, social insurance numbers (SIN), and student loan balances of students who were recipients of the loan program from 2000 to 2006 in 10 provinces and territories, including Ontario.
No banking or medical records were compromised. However, records of 250 employees of the department were also on the hard drive.
The Royal Canadian Mounted Police and the Office of the Privacy Commissioner are both investigating the matter.
Diane Finley, Minister of Human Resources and Skills Development, called the loss “unacceptable and avoidable,” and said new security policies would be put in place to ensure the safety of Canadians’ personal information. Finley also promised that the department would make efforts to inform those affected by the privacy breach.
“The department will be making every effort to contact the individuals whose information was lost. This includes direct
notification to those for whom we have current contact information,” Finley said in a statement released Friday. For those whose contact information is not up to date, a phone number has been set up by the department to address concerns.
Jaroslava Avila graduated from U of T in 2011, and received federal loans in 2005 and 2006. She says she is still unsure if she has been personally affected by the breach.
“This is just one more thing for students to worry about on top of paying thousands of dollars in students loans,” said Avila.
Munib Sajjad, vice-president, university affairs, of the University of Toronto Students’ Union, says he had around $6,000 of federal loans taken out during the time frame in question. His personal information may also have been comprised in the breach.
“I’m kind of baffled, and really, really surprised that our government is losing student records,” said Sajjad.
UTSU president Shaun Shepherd says he is deeply concerned by the loss. “I’m surprised and I’m disappointed by the fact that a significant amount of student information is out there and no one knows where it is. That’s a scary concept.”
Shepherd notes that the HDRSC is currently describing the information as “lost” rather than stolen.
“I don’t understand how that amount of information is kept on a hard drive and lost,” said Shepherd. “I’m hopeful that maybe it’s just been misplaced.”
As of The Varsity’s press time, significant questions remain unanswered regarding the loss.
According to a timeline released by the HDRSC, the hard drive was first reported missing on November 5, 2012. But the Departmental Security Officer was not notified until November 28, and it was not until December 6 that the department discovered what was on the lost hard drive.
Departmental spokesperson Christian Plouffe declined to comment on either gap. Plouffe also declined to comment on why the RCMP was first informed about the matter on January 7, 2013, over two months after the hard drive was first reported missing.
Canadian Federation of Students chair Adam Awad appeared to take the timeline at face value. “Their response was that they weren’t aware that the drive contained the information until several weeks after it was first reported lost,” said Awad.
Awad believes the government is taking the appropriate steps now. “We appreciate that they set up a hotline and that they’re taking efforts to monitor the students’ accounts that were affected,” said Awad.
The Varsity contacted the Office of the Privacy Commissioner, who said they had been notified verbally on December 17, and received written notification on January 7. The Privacy Commissioner only launches investigations where a “serious possibility” of a breach of the Privacy Act exists. “The OPC is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy rights of Canada,” read a statement sent to The Varsity by manager of external communications Scott Hutchinson.
University officials were informed of the breach by the provincial Ministry of Training, Colleges, and Universities. The Ontario ministry informed universities via an announcement routed through the Ontario Association of Student Financial Aid Administrators. It remains unclear how many former and current U of T students are affected although U of T spokesperson Laurie Stephens has confirmed the university is looking into the matter.
Stephens said the university stores records received from the HDRSC. “The university has strong security procedures around storage and access in order to safeguard the personal financial information of students,” Stephens said in an email.
