Four million Ontarians are being advised to monitor their bank accounts and credit card statements for suspicious activity after “systemic failures” at Elections Ontario led to the loss of personal voter information.

Information and Privacy Commissioner Dr. Ann Cavoukian slammed the agency Tuesday following an investigation into the loss of two USB keys containing unencrypted personal information for as many as 2.4 million voters.

Because Elections Ontario could not determine which of 20 to 25 electoral districts out of a possible 49 were impacted, the privacy breach affects potentially four million voters, Cavoukian says in a news release.

“Personal information is the currency in which Elections Ontario trades,” she says. “I am astounded at the failure of senior staff to address the security and technological challenges posed by the decision to locate the project off site... Ultimately, at the root of the problems uncovered in the court of my investigation was a failure to build privacy into the routine information management practices of the agency.”

Ontario Chief Electoral Officer Greg Essensa said on July 17th that there was no evidence that the personal information on the two USB keys had been improperly accessed.

“And the data itself can only be accessed in an intelligible form using internal Elections Ontario proprietary software or specialized commercial software applications,” Essensa says in his official response to the loss of voter information. “However, I want to exercise the highest degree of caution.” 

The information on the USB keys identified voters by their full name, gender, birth date and address, and noted whether that person had voted in the October 2011 provincial election.

The privacy commissioner’s report says that staff at Elections Ontario released the USB keys were missing on April 26, but the public wasn’t notified until July 17.

During that gap in time, the project continued using a replacement set of USB keys with an encryption capability that was never activated, the report says.

The privacy commissioner is recommending that Elections Ontario hire an independent third party to audit personal information managment polices, practices and procedures and develop a mandatory privacy training program for staff.

Voters in the following electoral districts could be impacted:

Ajax—Pickering
Algoma—Manitoulin
Ancaster—Dundas—Flamborough—Westdale
Brampton West
Brant
Bruce—Grey—Owen Sound
Burlington
Davenport
Don Valley East
Don Valley West
Essex
Etobicoke Centre
Etobicoke North
Etobicoke—Lakeshore
Haliburton—Kawartha Lakes—Brock
Halton
Hamilton Centre
Kingston and the Islands
Kitchener Centre
Kitchener—Conestoga
London North Centre
London West
London—Fanshawe
Mississauga South
Mississauga—Streetsville
Nepean—Carleton
Newmarket—Aurora
Nickel Belt
Nipissing
Northumberland—Quinte West
Ottawa South
Ottawa West—Nepean
Ottawa—Vanier
Peterborough
Pickering—Scarborough East
Prince Edward—Hastings
Sarnia—Lambton
Sault Ste. Marie
Scarborough—Agincourt
Simcoe North
Simcoe—Grey
Stormont—Dundas—South Glengarry
Timiskaming—Cochrane
Timmins—James Bay
Toronto Centre
Whitby—Oshawa
Windsor West
York Centre
York West