 | Today, Greg Essensa the Chief Electoral Officer of Ontario notified Ontarians that a privacy breach has occurred that impacts certain Ontario electoral
districts. This information is limited to full name, gender, birth date, address, as well as administrative
codes used solely for election purposes. Locally, the ridings of Essex and Windsor West are listed amongst the potential problem ridings. | |
Toronto - July 17, 2012 - My name is Greg Essensa and I am the Chief Electoral Officer of Ontario.
I am here today to notify Ontarians that a privacy breach has occurred that impacts certain Ontario electoral
districts.
Let me be clear, there is no evidence that copies of personal information on two USB keys have been
improperly accessed. And the data itself can only be accessed in an intelligible form using internal Elections
Ontario proprietary software or specialized commercial software applications.
However, I want to exercise the highest degree of caution.
Please note - this information is limited to full name, gender, birth date, address, as well as administrative
codes used solely for election purposes and any other personal information updates provided to Elections
Ontario by voters during the last election period. The information also includes whether or not an individual
voted in the October 2011 provincial election.
The information at issue DOES NOT include how an individual voted. We do not have such information because
the voting process guarantees the secrecy of the vote.
Nor does the information include Social Insurance Numbers, Ontario Health card information, driver’s licence
information, telephone numbers, email addresses, credit card or banking information, or information provided
by voters during the 2011 provincial election to confirm their identify or residence.
It is a breach because I cannot confirm the security of the information, not because we are aware of any
personal information being accessed inappropriately.
This applies to approximately 20-25 of the total 107 electoral districts.
Elections Ontario has specific policies and procedures in place regarding the management and care of personal
information that were not followed. Specifically, we have policies in place dictating that if USB keys are to be
used to carry personal information then those keys must be password protected and encrypted to secure the
information.
Also, these password protected and encrypted USB keys must be in the custody of Elections Ontario personnel
at all times.
I regret to report that two USB keys carrying copies of voter information for 20-25 electoral districts were not
password protected and encrypted and are not in Elections Ontario’s custody.
Elections Ontario personnel did not follow policy regarding two USB keys containing copies of the voter
information referenced earlier. The appropriate actions will be taken.
The staff who last worked with the USB drives advised that it is likely, based on their work processes, there was
information for three electoral districts on one USB drive and information from 17-22 electoral districts on the
other USB drive.
At the time, the team was working on 49 electoral district files as part of updating the Permanent Register of
Electors for Ontario.
The 20-25 impacted electoral districts were within the universe of the 49 electoral districts. Elections Ontario
has engaged forensic experts to confirm the exact 20-25 electoral districts of the 49. At this time, these experts
are unable to confirm the specific 20-25 electoral districts.
For that reason, and out of an abundance of caution, we are notifying Ontarians in all of the 49 electoral
districts.
The list is appended to the report and press release you received today.
I take this matter extremely seriously and I sincerely apologize to all Ontarians for any concern that this
notification may cause.
We have undertaken a rigorous search as well as undertaken a full internal investigation to completely review
the matter and circumstances leading to the USB keys’ disappearance.
We engaged external counsel, Gowling Lafleur Henderson LLP, to undertake and guide a full investigation,
supported by INKSTER Incorporated, a forensic security specialist firm.
Their investigation is still underway.
As part of today’s notification, you have a copy of the “Preliminary Report Regarding the Privacy Breach at
Elections Ontario” as prepared by Gowlings. This public report is being distributed with the press release today
and will be posted to our website.
On advice of counsel and their forensic specialists, I have reported this matter to the Ontario Provincial
Police. The OPP is investigating.
I have also asked the Information and Privacy Commissioner of Ontario to assist Elections Ontario in a full
review of our privacy policies and procedures and to consult with us in ensuring that this circumstance is not
repeated.
I have consulted with the Commissioner’s Office on matters concerning “Best Practices” to notify Ontario
voters.
Beginning tomorrow, July 18, an open letter will run in newspapers across the province targeting Ontarians in
the impacted electoral districts to notify them further of this matter and to recommend what care they should
exercise. In addition, as a precaution, to monitor for potential unusual activity regarding their transactions with
government, banks, utilities and others.
We have also placed information on our website and distributed today’s press release and the Gowlings
“Preliminary Report” through social media channels as well as the newswire.
To provide support to Ontarians we have set up a call centre to address any public inquiries regarding this
notification, including confirming what electoral districts individual voters may reside within.
I will be tabling a comprehensive report to the Legislative Assembly about this matter by year-end, summarizing
the outcomes of the Gowlings and INKSTER Incorporated investigation the OPP investigation and the
Information and Privacy Commissioner’s review.
Finally, since receiving the final “Preliminary Report Regarding the Privacy Breach at Elections Ontario”,
prepared by Gowlings, I have immediately directed the following:
· First, separate from the Commissioner’s work, an immediate and comprehensive review of all
Elections Ontario policies, processes, procedures and protocols related to the privacy,
management, protection and custody of voter information including staff orientation, training,
management oversight and accountability and audits.
· Second, immediate and comprehensive review of Elections Ontario’s Technology strategic
framework, infrastructure and management policies and oversight.
Both activities will be undertaken by external expert resources, directly accountable to me.
Again, I would like to reiterate, that to our knowledge, no voter information has been inappropriately accessed.
Out of an abundance of caution and in consideration of my accountability to the people of Ontario, I am making
this notification today.
|
