The List: Canada Student Loan Privacy Breach
Imagine being on a list that 583,000 Canadians are on.
You might say...
"Wow, what did I, Joe Smith, from small town Canada do to be on this list?" As it turns out, Joe Smith simply took out a student loan between 2000 and 2006.
His private information is now missing.
The following is a timeline of events...
• November 5, 2012: Revenue Canada employee discovers an external hard drive is missing.
• November 28: Departmental security officer is notified.
• December 6: Officials learn personal information of 583 thousand Canada Student Loans clients from 2000 to 2006 is on the missing hard drive.
• December 14: The Office of the Privacy Commissioner is notified of the missing hard drive.
• Jan.
7, 2013: The incident is referred to the Royal Canadian Mounted Police.
Like a poorly written story, there are quite a few plot holes that need to be filled.
Do you have a right to know how and why? Of course you do.
On November 5th, 2012 an employee of "Human Resources and Skills Development Canada" or the HRSDC discovered that an external hard drive was missing.
The staff of the HRSDC naturally decided to wait nearly an entire month before notifying the departmental security officer on November 28th.
It was approximately 9 days later before it was determined what information was contained on the hard drive.
The HRSDC held onto this information for another 9 days before notifying the office of the privacy commissioner on December 14th.
2 months after the hard drive initially was reported missing; the decision was finally made to report the theft to the RCMP on January 7th.
I'm sure we all have questions to ask about this situation.
My question...
why did it take a full month to determine what was on the missing hard drive? And why was it a full month and a half after the security officer was notified that the RCMP was brought into this sticky situation.
My best, uneducated in the art of losing hard drives with sensitive information on them, guess is that it was easier to stall a little...
oh say 2 months before reporting this situation to the RCMP...
maybe it'll just turn up like a missing set of keys between couch cushions thus avoiding a media thunderstorm.
No harm, no foul? Feeling helpless? I know I am.
Is there anything that could have done to prevent this violation of privacy? Perhaps traveling back in time to convince your-self that not getting a student loan would be a viable option.
Alas, like many Canadians I had no choice.
I needed an education and needed help to get from where I was to where I wanted to be.
This sounds a lot like a hyped up Hollywood drama of a "missing hard drive" containing sensitive information of hundreds of thousands of Canadians.
Stolen information includes...
· Social Insurance Number · Date of Birth · Full Name · Address All of that information, just "out there".
Waiting for somebody to use your identity when they feel the least likely to be caught.
To find out if you are on that "list" you have to make a phone call.
During the call I had to prove I was who I said I was.
I was asked to provide my sin number, my address and my full name.
At first glance this was fantastic security! However, considering the information I was asked to provide is the information contained on the missing hard drive, the security wasn't great after all.
During the conversation insult was added to injury.
I had to listen to a long spiel of information, of which I do not remember...
it was a supplied by the government of Canada, cover our butts as much as possible script.
I finally had the opportunity to ask a question.
"How will this breach in security affect my loan?" A fair question.
The response I received was outright insulting...
"Well you still have to pay your loan.
" As a Canadian you have a right to ask questions.
It was apparent the answer to MY question was not on her supplied script.
This employee let me know that the government will only flag the affected sin number for 12 months...
interesting.
So if you found out you're on "the list" and you're wondering...
"What should I do now?" Call both credit bureaus immediately.
Tell them you are on the "list".
You are at high risk to have your identity stolen.
Equifax: 1 800 465 7166 TransUnion: 1-800-663-9980 Be aware that when you call, you will have to listen to a sales pitch.
Yes, you will be peddled added security you should rightfully have anyway.
I turned down the sales pitch, employee was no longer friendly.
Funny how that works.
If you choose, you can join thousands of Canadians on the list you SHOULD be on.
The class action lawsuit list.
The right to privacy is a powerful thing.
You might say...
"Wow, what did I, Joe Smith, from small town Canada do to be on this list?" As it turns out, Joe Smith simply took out a student loan between 2000 and 2006.
His private information is now missing.
The following is a timeline of events...
• November 5, 2012: Revenue Canada employee discovers an external hard drive is missing.
• November 28: Departmental security officer is notified.
• December 6: Officials learn personal information of 583 thousand Canada Student Loans clients from 2000 to 2006 is on the missing hard drive.
• December 14: The Office of the Privacy Commissioner is notified of the missing hard drive.
• Jan.
7, 2013: The incident is referred to the Royal Canadian Mounted Police.
Like a poorly written story, there are quite a few plot holes that need to be filled.
Do you have a right to know how and why? Of course you do.
On November 5th, 2012 an employee of "Human Resources and Skills Development Canada" or the HRSDC discovered that an external hard drive was missing.
The staff of the HRSDC naturally decided to wait nearly an entire month before notifying the departmental security officer on November 28th.
It was approximately 9 days later before it was determined what information was contained on the hard drive.
The HRSDC held onto this information for another 9 days before notifying the office of the privacy commissioner on December 14th.
2 months after the hard drive initially was reported missing; the decision was finally made to report the theft to the RCMP on January 7th.
I'm sure we all have questions to ask about this situation.
My question...
why did it take a full month to determine what was on the missing hard drive? And why was it a full month and a half after the security officer was notified that the RCMP was brought into this sticky situation.
My best, uneducated in the art of losing hard drives with sensitive information on them, guess is that it was easier to stall a little...
oh say 2 months before reporting this situation to the RCMP...
maybe it'll just turn up like a missing set of keys between couch cushions thus avoiding a media thunderstorm.
No harm, no foul? Feeling helpless? I know I am.
Is there anything that could have done to prevent this violation of privacy? Perhaps traveling back in time to convince your-self that not getting a student loan would be a viable option.
Alas, like many Canadians I had no choice.
I needed an education and needed help to get from where I was to where I wanted to be.
This sounds a lot like a hyped up Hollywood drama of a "missing hard drive" containing sensitive information of hundreds of thousands of Canadians.
Stolen information includes...
· Social Insurance Number · Date of Birth · Full Name · Address All of that information, just "out there".
Waiting for somebody to use your identity when they feel the least likely to be caught.
To find out if you are on that "list" you have to make a phone call.
During the call I had to prove I was who I said I was.
I was asked to provide my sin number, my address and my full name.
At first glance this was fantastic security! However, considering the information I was asked to provide is the information contained on the missing hard drive, the security wasn't great after all.
During the conversation insult was added to injury.
I had to listen to a long spiel of information, of which I do not remember...
it was a supplied by the government of Canada, cover our butts as much as possible script.
I finally had the opportunity to ask a question.
"How will this breach in security affect my loan?" A fair question.
The response I received was outright insulting...
"Well you still have to pay your loan.
" As a Canadian you have a right to ask questions.
It was apparent the answer to MY question was not on her supplied script.
This employee let me know that the government will only flag the affected sin number for 12 months...
interesting.
So if you found out you're on "the list" and you're wondering...
"What should I do now?" Call both credit bureaus immediately.
Tell them you are on the "list".
You are at high risk to have your identity stolen.
Equifax: 1 800 465 7166 TransUnion: 1-800-663-9980 Be aware that when you call, you will have to listen to a sales pitch.
Yes, you will be peddled added security you should rightfully have anyway.
I turned down the sales pitch, employee was no longer friendly.
Funny how that works.
If you choose, you can join thousands of Canadians on the list you SHOULD be on.
The class action lawsuit list.
The right to privacy is a powerful thing.
Source...