The personal information of 583,000 Canada Student Loan borrowers and 250 departmental employees was lost after an external hard drive went missing from a Human Resources and Skills Development Canada (HRSDC) office in Gatineau, Quebec.

This loss of information will affect students who took out a student loan between 2000 and 2006. However, it will not affect borrowers from Quebec, Nunavut and the Northwest Territories at this time, as these systems are managed separately.

The information was stored on the external hard drive as a backup storage option for the information.

Although the Human Resources and Skills Development Canada states that the hard drive did not contain any banking or medical information, the sensitive nature of this personal information is troubling for many individuals. Names, birth dates, social insurance numbers, Canada Student Loan balances, and addresses were among the information lost on the hard drive.

The requirements for obtaining a driver’s license are a birthdate, full legal name, signature, photograph, and address. With the full name, date and location of birth, address, and parental information, one can apply for a birth certificate. It is with identification such as this that an individual can apply for a credit card or bank account.

“The department will be making every effort to contact the individuals whose information was lost,” stated the Honourable Diane Finley, Minister of Human Resources and Skills Development in a statement released on January 11th, 2013. “This includes direct notification to those for whom we have current contact information. I am releasing all details on the breach publicly and we will be working with a number of external partners to ensure that Canadians are made aware of the data loss. The Department is continuing its investigation. The Office of the Privacy Commissioner has been consulted. My office has engaged the Royal Canadian Mounted Police on this matter, given its serious nature.”

It was on November 5th, 2012 that it was first discovered by a Human Resources and Skills Development Canada employee that the hard drive was missing and the subsequent search efforts began. The HRSDC departmental security officer was notified twenty-three days later on November 28th. It was on December 6th that it was detected that the hard drive contained the personal information of Canada Student Loans program clients. The Office of the Privacy Commissioner was notified on December 14th. It was only on January 7th that the Royal Canadian Mounted Police were notified. The news of this event was finally released to the general public on January 11th, sixty-six days after the hard drive was lost.

This event was announced just months after a USB stick carrying the personal information of 5,000 Canadians was lost in November by the Human Resources and Skills Development Canada. That USB stick contained social insurance numbers, medical records and birth dates. It was during the investigation of this USB stick that it was realized that the external hard drive was missing.

“I have requested that HRSDC employees across Canada receive comprehensive communications on the seriousness of these recent incidents and that they participate in mandatory training on a new security policy to ensure that similar situations do not occur again,” said Finley. “Further, I have instructed that the new policy contain disciplinary measures that will be implemented for staff, up to and including termination, should the strict codes of privacy and security not be followed.”

If you believe that you may be affected by this security breach, you can contact HRSDC at 1-866-885-1866, from 8:00 am – 8:00 pm EST.

Republished from The Quill print edition, Volume 103, Issue 18, January 22, 2013.