Skip to main content

Canada Privacy commissioner 'deeply disturbed' by Election Ontario's handling of voter data

Elections Ontario

J.P. Moczulski/The Canadian Press

Elections Ontario ignored security policies and went right back to using memory sticks without enabling the encryption software just days after personal information for as many as 2.4 million voters – contained on two USB keys without the necessary safeguards – vanished from one of its warehouses, the province's privacy commissioner has charged.

Ann Cavoukian, Ontario's Information and Privacy Commissioner, took aim at Elections Ontario managers for not properly training workers on security policies, saying she was "deeply disturbed" that such a privacy breach could occur.

"On what planet do you do the same thing again, and you don't encrypt the data again? It's baffling to me," Ms. Cavoukian told reporters on Tuesday at Queen's Park as she released her investigative report on Elections Ontario's privacy breach. "Front-line staff remain ill-informed on the meaning of encryption or how to deploy the encryption capabilities."

Story continues below advertisement

Two USB keys that were not encrypted and contained the names, addresses, genders and birth dates for residents of as many as 25 ridings and information on whether they voted in the last election disappeared in late April – and have not been located. Elections Ontario has warned voters to be vigilant for identity theft.

The privacy breach raised broader questions about how securely the government and its agencies store personal information. The Ontario Provincial Police is investigating.

"The implications of this massive data breach are considerable both in terms of the possibility for identity theft and other deceptive practices, which often do not arise for well over a year after a breach has transpired," Ms. Cavoukian said, adding that the source of the data makes it all the more valuable.

In the second incident, managers discovered other USB keys not being used correctly and quickly took steps to encrypt the data. But Ms. Cavoukian said what was just as distressing is that Elections Ontario staff did not understand what encryption entailed, and confused it with compressing files.

Among Ms. Cavoukian's recommendations was appointing a chief privacy officer and developing a privacy-training program to be given to Elections Ontario staff annually. "The absolute key is," she said, "that which is contained in your policy should be reflected in your practice."

A spokeswoman for Elections Ontario said the agency is reviewing the privacy commissioner's report and will address changes by the end of the year, once all investigations are complete. Brendan Crawley, a spokesman for the Ontario Ministry of the Attorney-General, said the government is also reviewing the recommendations.

Elections Ontario said that in the case of the USB keys that went missing, two staff members working in a warehouse in late April updating the permanent register of electors for Ontario did not follow the rules. Policies dictate that memory sticks containing personal information must be password-protected and encrypted, and be in the custody of staff at all times.

Story continues below advertisement

The two were supposed to secure the USB keys at the end of the work day, but failed to do so.

The next morning when they returned to work, the keys were gone.

Both workers are no longer employed by Elections Ontario.

Report an error Editorial code of conduct
Comments

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • All comments will be reviewed by one or more moderators before being posted to the site. This should only take a few moments.
  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed. Commenters who repeatedly violate community guidelines may be suspended, causing them to temporarily lose their ability to engage with comments.

Read our community guidelines here

Discussion loading ...

Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.
Cannabis pro newsletter