Voters in London-North-Centre enter the London Trinity Lutheran Church to cast their vote on October 6, 2011.
Credits: SUE REEVE/THE LONDON FREE PRESS/QMI AGENCY
Information and Privacy Commissioner Dr. Ann Cavoukian slammed the agency Tuesday following an investigation into the loss of two USB keys containing unencrypted personal information for as many as 2.4 million voters.
Because Elections Ontario could not determine which of 20 to 25 electoral districts out of a possible 49 were impacted, the privacy breach affects potentially four million voters, Cavoukian says in a news release.
“Personal information is the currency in which Elections Ontario trades,” she says. “I am astounded at the failure of senior staff to address the security and technological challenges posed by the decision to locate the project off site... Ultimately, at the root of the problems uncovered in the court of my investigation was a failure to build privacy into the routine information management practices of the agency.”
Ontario Chief Electoral Officer Greg Essensa said on July 17th that there was no evidence that the personal information on the two USB keys had been improperly accessed.
“And the data itself can only be accessed in an intelligible form using internal Elections Ontario proprietary software or specialized commercial software applications,” Essensa says in his official response to the loss of voter information. “However, I want to exercise the highest degree of caution.”
The information on the USB keys identified voters by their full name, gender, birth date and address, and noted whether that person had voted in the October 2011 provincial election.
The privacy commissioner’s report says that staff at Elections Ontario released the USB keys were missing on April 26, but the public wasn’t notified until July 17.
During that gap in time, the project continued using a replacement set of USB keys with an encryption capability that was never activated, the report says.
The privacy commissioner is recommending that Elections Ontario hire an independent third party to audit personal information managment polices, practices and procedures and develop a mandatory privacy training program for staff.
Voters in the following electoral districts could be impacted:
Don Valley East
Don Valley West
Kingston and the Islands
London North Centre
Sault Ste. Marie