Privacy Commissioner’s Office Concludes Investigation into Privacy Breach at Ministry of Children, Community and Social Services

Notice of Resolution for PR18-00067 – Ministry of Children, Community and Social Services

On December 24, 2018, the Ministry of Children, Community and Social Services (MCCSS) was notified by an individual that there had been a privacy breach involving clients of the Ontario Disability Support Program (ODSP). An email was sent on December 20, 2018, by a ministry employee with a spreadsheet attached in error and sent to 103 of the clients from this list. The spreadsheet contained the personal information of 45,344 ODSP clients. The personal information contained in the spreadsheet consisted of the name, client ID number, and email address of each individual. The MCCSS explained that the spreadsheet was attached to the email in error.

MCCSS reported this breach to the IPC on December 24, 2018. The IPC worked with the ministry to ensure that it took reasonable steps to notify the affected individuals, contain the breach and prevent a future occurrence. Steps taken by MCCSS to remedy the breach included:

• staff education;
• privacy training;
• ensuring that all spreadsheets created containing information of its clients require a password to access them, and if sent by email are sent using encryption;
• the MCCSS has also implemented a MyBenefits portal which allows staff to communicate securely with recipients which will, in time, replace email communication and help in avoiding future errors.

The ministry is also developing a comprehensive privacy training plan that will target programs that handle large amounts of personal information as part of their mandate. ODSP staff (that account for approximately 1600 staff within the Ministry) will undergo the updated training first. Other program areas will be targeted in future training phases and will benefit from the promotion of online privacy training.

The analyst decided that the remediation steps taken, and those committed to be taken by MCCSS, were satisfactory and the file has been resolved.