A government department lost a hard drive containing the personal information of almost 600,000 Canada Student Loan borrowers, according to a Jan. 11 statement.
The portable hard drive contains the names, addresses, dates of birth, loan balances, and Social Insurance Numbers of 583,000 people who used the Canada Student Loans Program between 2000 and 2006. A Human Resources and Skills Development Canada (HRSDC) employee in Gatineau, Que. lost the drive on Nov. 5, 2012.
Borrowers from Quebec, Nunavut, and the Northwest Territories were not affected, as their data was not stored on the drive.
Although the drive has not been recovered, the department says there have been no signs yet that the data on it has been used for fraud.
The data on the hard drive was not encrypted though department policy said it should have been, HRSDC’s media relations office said via email. As such, the data can be accessed by any computer without the need for a unique password.
“I want all Canadians to know that I have expressed my disappointment to departmental officials at this unacceptable and avoidable incident in handling Canadians’ personal information,” Diane Finley, minister of HRSDC, said in a statement.
HRSDC is sending out letters to affected borrowers, and has set up a hotline individuals can call to find out if their data was lost.
Holly Gilroy, vice-president (academic) of Carleton’s Graduate Students’ Association, is among those whose information has been lost.
“I’m disappointed in the [department]. I understand that accidents happen — that’s part of life — but this data has been lost since November, and it’s just coming to light now . . . I definitely think they had a responsibility to let us know as soon as possible.”
Although the hard drive was lost in November, HRSDC said they did not know it contained personal information until Dec. 6.
In response to the loss, St. John’s lawyer Bob Buckingham launched a class-action lawsuit on behalf of everyone affected.
“It’s surprising to everyone that they would put information of a personal, sensitive, financial, and familial nature of 583,000 people onto a disk that someone could walk off with,” Buckingham said of HRSDC.
Buckingham said he believes that the data lost may include information on family members, a claim that HRSDC denies.
According to several sources, the government has offered one free credit check to those affected. If an individual wants up-to-date information, they would have to purchase their own credit monitoring services.
“Think about that—583,000 people, having to get credit checks at $14 a month . . . people will be paying money out of pocket for a long time,” Buckingham said.
“The monetary damages are astronomical,” he added. “There’s also damages for the breach of privacy, the breach of trust, harm because of negligence and stress. . . The financial consequences are going to be significant.”
But Buckingham said that borrowers are primarily concerned with having their identity secured.
“Costs will come later. Right now, people want peace of mind and they want their fear eliminated about what could happen to them.”
Buckingham has asked Finley for a meeting concerning the issue.
Gilroy isn’t yet sure if she’s going to have her credit monitored, but said she doesn’t think it’s fair the government is asking people to pay for the service.
“I think this is a bit disappointing to students,” she said. “It’s a somewhat vulnerable population . . . a lot of those people are still really deeply in debt.”
“Some students have had such a hard time with their loans, and such a run-around from [HRSDC] . . . I think there’s some more anger from people than there would be if [the loss happened with] some agency that was easy to deal with,” she said.
In response to the loss, HRSDC implemented new security protocols, which include a ban on portable hard drives in their offices.
