Dr. Ann Cavoukian, Information & Privacy Commissioner, Ontario
When last October’s provincial election
resulted in a minority government, Elections Ontario had to prepare for the
possibility of an unexpected subsequent poll. While conducting its required post-election
update of the Permanent Register of Elections for Ontario (known as the
Strike-Off Project), the agency lacked the capacity at its headquarters for
storing additional materials in case of another election. A decision was made to move the data
update project to a leased warehouse located nearby. The elector data was
transferred between members of the project using two USB keys. On April 26,
staff at Elections Ontario realized the USB keys had gone missing—the same keys
that contained the unencrypted personal information of as many as 2.4 million
voters.
Ontario Information and Privacy
Commissioner Dr. Ann Cavoukian has investigated what is now being coined the
“largest privacy breach in Ontario history,” and she released her findings on
Tuesday of this week. Dr. Cavoukian said the issue can be traced back to
Elections Ontario’s failure to systematically address privacy and security
issues.
“Personal information is the currency in
which Elections Ontario trades,” the Commissioner said. “I am astounded at the
failure of senior staff to address the security and technological challenges
posed by the decision to locate the project off-site. Ultimately, at the root
of the problems uncovered in the course of my investigation was a failure to
build privacy into the routine information management practices of the agency.”
