CBSA officer caught leaking police information to family members: internal docs

A Canada Border Services Agency agent breached federal privacy law when she took a photo of confidential police information and emailed it to a member of her family, says an internal report.

According to a copy of the findings, recently obtained by CBC News through access to information law, the Calgary Police issued a wanted bulletin to the CBSA​​​​​​ to give agents a heads-up about a traveller who was expected to pass through the city's airport.

The details of the 2017 bulletin are redacted but it included a wealth of facts about the subject of the bulletin: name, date of birth, photo, criminal attributes, criminal history and medical concerns, plus the police service's views on the threat posed by the individual.

The bulletin was never made public.

"There is no indication that he behaved erratically or posed any problems," wrote a CBSA intelligence officer in an email to staff about the subject of the wanted bulletin.

One CBSA officer took a photo of the bulletin on her personal phone and emailed it to her brother, who then sent an email to Calgary police expressing concerns — and unintentionally tattling on his sister.

Employees' status unknown

The police force alerted the border agency, spurring a CBSA investigation. The employee was removed from her workplace and her access was restricted.

"It was confirmed that the allegations were true by way of an admission of guilt by the CBSA employee," notes the breach report.

The subject of the bulletin also was told about the breach.

It's not clear if the CBSA officer was subsequently fired. The CBSA won't comment, citing privacy concerns. 

"The Canada Border Services Agency (CBSA) takes the issue of privacy very seriously. The agency's investigation is now complete. Ongoing reviews and improvements to our processes, training programs, screening standards, and employee awareness help to further strengthen our agency's protection of privacy," wrote agency spokesperson Luke Reimer.

"The CBSA and Calgary Police Service continue to share information, under strict legal parameters, in our joint commitment to public safety. The CBSA works with domestic and international law enforcement partners to identify individuals, groups, and businesses that are suspected to be involved in illicit activity and regularly shares with its partners relevant intelligence information, on border and national security issues."

Despite the gaffe, the Calgary police said its "processes, policies and relationship" with the CBSA have not changed.

It's not the first time the CBSA has been hit by a breach. In 2016 the agency violated a refugee claimant's privacy when personal information encrypted on a USB key disappeared — with the password written on a Post-it note left wrapped around the device.

Cases of serious breaches — sometimes referred to as "material breaches" — have to be reported soon after they occur to Canada's privacy commissioner and to the Treasury Board of Canada Secretariat.