Elections Ontario’s Unprecedented Privacy Breach: A Special Investigation Report

Investigation into the loss of two USB keys containing unencrypted personal information that were used by the Strike-off Project of Elections Ontario (EO).

Findings:

EO failed to put in place reasonable measures to protect the physical security, and the privacy and security of the personal information in its custody and control and, in particular, failed to ensure that the personal information stored on mobile electronic devices was encrypted.

EO failed to take steps to ensure that existing policies were reflected in actual practice; failed to ensure that senior staff were accountable and responsible for privacy and security; failed to adequately train its staff; and, failed to respond adequately to the privacy breach by continuing to store unencrypted data on USB keys after having learned of the privacy breach.

Recommendations:

Retain the services of an independent third party to conduct a thorough and comprehensive audit of all of the personal information management practices at EO;

Develop an overarching privacy policy;

Establish Technology Services as the centre of responsibility and accountability at EO for implementation of strong measures to protect the privacy and security of personal information on all electronic devices and for ensuring that staff are fully trained and supported regarding the use of these devices;

Appoint a Chief Privacy Officer;

Develop a comprehensive, mandatory privacy training program for all staff;

Develop an ongoing communications plan to ensure that all staff are made aware of and are reminded of EO’s privacy and security policies.

In addition, the Report recommends that the government of Ontario ask the Auditor General of Ontario to conduct privacy audits of the information management practices of selected public sector agencies in the province; and conduct a review and modernization of the Election Act to ensure that the privacy and security of the personal information in the custody of EO is strongly protected and used prudently, as prescribed.