Question Period Note: PRIVACY BREACHES DUE TO LOST PASSPORTS

An article in La Presse on November 23, 2024, found on average one Canadian passport is lost per day (1.1/day). Passports are sent by registered mail through Canada Post (when no labour disruptions). Most passport privacy breaches involve misdirected passports in the mail, which are then opened by the wrong recipient.

On October 28, 2024, an investigation by CBC’s The Fifth Estate and Radio-Canada revealed significant concerns about the security of personal information, including underreporting of breaches. Moreover, through an Order Paper Question (Q-2954), an MP requested information on privacy breaches for all departments of the Government of Canada.

• Privacy is a fundamental right in Canada and the Government works diligently to protect the personal information of Canadians.

• When a risk of privacy breach is signalled or a breach occurs, the government takes every action to resolve the situation.

• The Passport Program follows an established procedure for managing and mailing protected information.

Material Breach
A material breach is a breach that could reasonably create a real risk of significant harm to an individual. Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

Privacy Breach Due to Lost Passports

Consistent with the TBS Policy on Privacy Protection, ESDC applies an established procedure for assessing the materiality of privacy incidents. All passports and applications that are deemed lost or stolen are automatically deemed material privacy breaches due to the real risk of significant harm to the individual given the sensitivity of the information involved.

The majority of passport breaches relate to those misdirected in the mail, which are opened by the wrong recipient. While they are still counted as privacy breaches, they are not deemed material breaches and are therefore no longer reported to the Office of the Privacy Commissioner (OPC). However, a notification letter is sent to the affected individual. In instances where a material privacy breach occurs, ESDC completes and submits an incident report to the OPC.

Mitigating measure

In June 2021, the Office of the Privacy Commissioner (OPC) published its report on passport protection practices, where they determined that in general the program had reasonable measures in place to prevent unauthorized disclosures of passports.

In response to the OPC’s recommendation to establish and implement reasonable service standards for timely notification to affected parties of lost or stolen passports, Immigration, Refugees and Citizenship Canada (IRCC) committed to working with Passport Program partners, including ESDC, to review the feasibility of implementing a client notification mechanism for mail delivery.

A recently introduced status checker tool is an example and initial step to notifying clients when their passport is mailed as the client is provided with a tracking number that will enable them to track the delivery of their passport.

To establish a set of supports for individuals who are at risk of identity theft, IRCC developed a credit monitoring assessment tool and shared it with ESDC and Global Affairs Canada (GAC). ESDC assesses each breach to determine if the credit monitoring assessment tool should be offered to affected clients to support their ability to monitor and identify any suspicious activities on their credit report.

If Pressed (Mitigation measures)

• All ESDC employees receive mandatory training on information management, privacy, and access to information.

• In instances where personal information may have been incorrectly disclosed, ESDC has procedures to investigate the incident and inform the client.

• ESDC is responsible for the investigation of lost, mislabelled, or misdirected packages. For every incident where personal information is incorrectly disclosed, a security report and reviews are conducted to implement corrective measures, as required, to avoid future incidents.
If pressed (Canada Post strike)
• The Passport Program has paused all residential delivery of passports. Pick up services remain available at all 10-day service passport locations; there are sixty of these across the country.

• Immigration, Refugees and Citizenship Canada (IRCC) has procured alternate mail delivery services from the three passport production centres to 60 points of service across the country with 10-day service.

• All Service Canada Centres will continue to receive clients and intake passport applications.