The Yukon government still doesn’t know exactly who in the territory was affected by a massive privacy breach in B.C. announced four months ago.
B.C.‘s privacy commissioner released a report yesterday scolding the province’s Ministry of Education for multiple lapses that led to a backup external hard drive being lost.
Information on 3.4 million people, including approximately 8,000 Yukoners, was on the drive.
Elizabeth Denham found that data had been transferred onto the unencrypted hard drive, which was against policy. As well, the ministry failed to record the existence of the hard drive or store it in a proper facility.
In a statement yesterday, Yukon’s deputy minister of education, Judy Arnold, said that when the department found out about the breach in September it requested that B.C. provide all the Yukon student data that may have been compromised.
That hasn’t happened yet.
“Once we receive this data, we will review it and complete the risk assessment with the Office of the Yukon Ombudsman & Information Privacy Commissioner,” the statement said.
“We can then determine additional safeguards that could be put in place. We will also notify individuals who have been impacted by the data breach.”
When it comes to Yukon records, the drive has names, genders, birthdates, postal codes and personal education numbers for all Yukon kindergarten to Grade 12 students from 1991 to 2009.
The drive also contains student exam and course information for the Yukon from 1991 to 2008. That particular file identifies students by number.
Arnold said in her statement that the Yukon government responded to the incident by “beginning a review of all of our information sharing agreements with B.C., with input from the Yukon Information and Privacy Commissioner” and “conducting privacy impact assessments for our internal data collection and storage in order to revise policies as needed.”
Arnold was not available for an interview in time for today’s paper.
Yukon’s privacy commissioner, Diane McLeod-McKay, said it’s important the Yukon government put clauses in contracts that allow the territory to evaluate whether or not the other jurisdictions holding Yukon data are in compliance with their data protection rules.
She said she didn’t know whether the Yukon Department of Education’s contracts have a clause like that.
“It’s really important that public bodies do have effective privacy management programs in place. As part of that contract management is a really important component,” she said.
“Yukon public bodies are not there yet. Many of them don’t have privacy policies and procedures.”
Unlike in B.C., where the privacy commission was able to launch her own independent investigations, McLeod-MacKay’s office is only a tool departments can call on for help if they want. If she could launch her own investigation she would, she said.
She cautions Yukoners to be aware that their information has gone missing. Someone could use that “sort of general information to try and convince a victim to reveal more private information.
“If you don’t know who you’re talking to, whether it be online or on the telephone, do not give out information.”
Anyone looking for more information on the breach can call the B.C. hotline at 1-604-660-2421.
Contact Ashley Joannou at