Late last week, the office of the Privacy Commissioner of Canada
announced a major breach within its own office with the loss of an
unencrypted hard drive containing sensitive personal information
relating to over 800 of its current and past employees. The
loss provides a test to Interim Privacy Commissioner Chantal
Bernier, who recently took over the top job on an interim basis
from departing Commissioner Jennifer Stoddart.
The Privacy Commissioner's office announced that the
information first went missing in mid-February during an office
move, and that the breach was discovered in mid-March. It was
not until early April that it was determined that the hard drive
contained sensitive financial information, including
salaries. Adding insult to injury, some of the missing
personal information dated back 12 years. It is not clear what
retention period should have applied to the data. Under Privacy
Act regulations, the Commissioner would be required to retain
the
