Skip to main content

Human Resources Minister Diane Finley speaks during Question Period in the House of Commons on Sept. 18, 2012. Ms. Finley has been ordered by a federal judge to ‘further consider’ her compliance in the HD Mining case.CHRIS WATTIE/Reuters

A massive privacy breach looks to land the federal government in court.

Two class-action lawsuits are being filed after Human Resources and Skills Development Canada lost a portable hard drive containing personal information about more than half a million people who took out student loans.

The department said last week the device contained data on 583,000 Canada Student Loans Program borrowers from 2000 to 2006.

The missing files include student names, social insurance numbers, dates of birth, contact information and loan balances of borrowers, as well as the personal contact information of 250 department employees.

Borrowers from Quebec, Nunavut and the Northwest Territories during this time period are not affected.

No banking or medical information was on the portable device.

Bob Buckingham, a St. John's, Nfld., lawyer who filed a statement of claim Thursday on behalf of those affected by the privacy breach, is warning the loss could affect more people than just the student-loan borrowers.

"We believe the number of people affected is, at minimum, two million, as the student-loan applications also contained information about the applicants' parents, siblings and spouses, where applicable," he said in a statement.

"This type of private data, in the wrong hands, can destroy lives."

Only the student-loan borrowers' information was on the portable hard drive, said a spokeswoman for Human Resources Minister Diane Finley.

"No other individuals' names or information were included, such as spouses or co-signers," Alyson Queen said in an email.

The loss of the hard drive from an office in Gatineau, Que., came to light as the department looked into another breach – a missing USB key containing the personal information of more than 5,000 Canadians.

Human Resources went public with the second, more far-reaching loss last week – more than two months after an employee discovered that an external hard drive was missing.

Lawyer Tony Merchant, who filed a separate class-action lawsuit Thursday, questioned why it took the government so long to disclose the data loss.

"One of the many important issues raised in this litigation is that this privacy breach involves the federal government having lost not just people's names and addresses, but also their SIN numbers and dates of birth, and that a loss discovered in early November was only disclosed to the Canadian public in January," he said in a statement.

"The people who have contacted our law firm wish to be promptly protected from identity theft or other misuse of their personal information."

The RCMP and the privacy watchdog are also investigating the loss.

A Liberal MP wrote Thursday to Ms. Finley, calling on the government to pay for credit-check reports for anyone affected by the data loss.

"This is simply unacceptable. Canadians should not have to pay for the mistakes of this government," Rodger Cuzner wrote.

The NDP has also criticized the government over the data loss.

Human Resources is sending letters to affected people, for whom it has current contact information, to advise them on how to protect their personal information.

A toll-free number has been set up at 1-866-885-1866 (or 1-416-572-1113 for those outside North America) to help people determine whether they are affected.

Interact with The Globe