These days, it seems that we hear of a major privacy breach every day which relates to misplaced personal data. But it’s not just a recent problem. Back in 2006, a Canada Revenue Agency (CRA) auditor copied 6 years worth of confidential taxpayer information onto 16 unencrypted CDs and proceeded to let a friend download one onto his laptop. Although the agency has policies and procedures in place with regards to this type of download, but they were not followed.

The breach came to light in 2009 during a grievance hearing in which the employee produced the material so that the Public Service Labour Relations Board could read a key 2005 email. Although she won £6k for her pain and suffering, the larger problem of the 16 unencrypted CDs came to light. The employee was able to recover and return them to the agency, but the laptop that held the downloaded file, which contained nearly 2,700 instances of confidential taxpayer information, could not be recovered.

Putting so much personal data at risk is not ideal. But the problem was made even worse when the agency deemed the incident to be “low risk” and therefore did not report it to the privacy commissioner, who is now asking why no one alerted her of the breach when it was discovered 2 years ago. The CRA has also admitted that although there were policies and procedures in place for safe-guarding data, employees themselves were generally unfamiliar with them.

No doubt staff training will be high on the CRA’s list of priorities. But regardless of steps being taken by the agency, even informed employees misuse confidential data. Along with training, companies should consider tighter security controls and an insurance policy which covers employee misconduct in cases like this.

See the full story on www.theglobeandmail.com
Our CPM policy covers employee dishonesty and other key privacy exposures. Click here for info.