Privacy watchdog examines possible breach in residential school survivors' claims

Canada's privacy watchdog is looking into a possible breach of personal information belonging to residential school survivors, after an adjudicator working for the agency handling their compensation claims filed a police report citing blackmail.

• Visit CBC Aboriginal
• Reconciliation: A new generation of aboriginal Canadians weighs in
• Reconciliation walkers surprise residential school survivors

The Indian Residential Schools Adjudication Secretariat is the administrative body that manages the claims made by residential school survivors. It is an independent, quasi-judicial tribunal established in 2007 under the Indian Residential Schools Settlement Agreement.

Indian residential school survivors can seek compensation for suffering "sexual or serious physical abuse or another wrongful act" through an independent assessment process managed by the agency.

A spokesperson for the agency told CBC News on Wednesday that "an individual contacted the Secretariat earlier this month" claiming to have information relating to claims made by residential school survivors.

"We have not determined if he actually has any confidential information," said Michael Tansey, a senior communications officer with the Indian Residential Schools Adjudication Secretariat, in an email to CBC News on Wednesday.

"The adjudicator has made a report to the police, and indicated that blackmail was involved."

• Read Charlie Angus's letter to the chief adjudicator
• Read Charlie Angus's letter to interim privacy commissioner

The adjudicator, whose identity Tansey said can not be made public, is on a leave of absence for an undetermined period of time. 

The news of a possible privacy breach of information belonging to Indian residential school survivors comes just as The Truth and Reconciliation Commission begins to hold its final hearings in Edmonton on Thursday, before submitting its final report in 2015.

Blackmailing reported to police

The Mounties would not say whether an investigation had been launched into the reporting of blackmail, citing concerns over preserving the integrity of a possible investigation.

"The RCMP can not confirm or deny investigations because to do so could jeopardize the integrity of any possible investigations," Laurence Trottier, a media relations officer for the RCMP told CBC News in an email Wednesday.

While it is not clear where the adjudicator filed the police report, Tansey said the agency which is headquartered in Ottawa has not filed a complaint with police, but reported the matter to three other groups.

"The Secretariat has not made a police report since we have not determined if anything has been stolen."

Tansey said the Secretariat informed the Department of Aboriginal Affairs and Northern Development Canada (AANDC) "shortly after" the agency became aware of it, and that it referred the matter to the Office of the Privacy Commissioner "this week."

The agency also reported the incident to its own Access to Information and Privacy (ATIP) co-ordinator.

The office for the federal privacy commissioner confirmed to CBC News on Wednesday that the matter was reported to them by the Department of Aboriginal Affairs.

"Aboriginal Affairs and Northern Development Canada contacted our office this week to notify us about a possible breach of personal information involving Indian Residential Schools Adjudication Secretariat," said Valerie Lawton, a senior communications adviser with the Office of the Privacy Commissioner.

More than 1 incident investigated

This is not the first time the privacy watchdog has been asked to look into a possible data breach where the claims of residential school survivors are concerned.

"We were notified about a separate incident last year," Lawton said.

While it is unclear whether last year's incident is in any way related to this month's event, Tansey confirmed that yet another possible data breach was investigated in 2012.

"We can confirm that a possible security breach was identified in 2012 related to information that may have been stolen from an adjudicator in the IAP."

"In 2012, it was determined that no breach had occurred," Tansey said.

When you have a major data breach, it's incumbent to call the privacy commissioner and to inform the people whose information has been taken or stolen.- Charlie Angus, NDP MP

New Democrat MP Charlie Angus, who represents a northern Ontario riding where a residential school once operated, said a breach of residential school data would be "catastrophic" to the survivors.

"I've been astonished to see this report that apparently confidential data from survivors of the residential schools was stolen, perhaps as far back as 2012, and that there may be criminal intent behind this," Angus said in a telephone interview with CBC News on Wednesday.

"When you have a major data breach, it's incumbent to call the privacy commissioner and to inform the people whose information has been taken or stolen."

Angus said he will be asking the privacy commissioner in a letter on Thursday to investigate the possible data breach. He wants to know if the incident happened earlier this month, why it is that the privacy watchdog was only informed about it this week.

Angus said he will also send a letter to the Secretariat asking for clarification on the possible data breach. 

"Have they contacted the survivors? Because this is very, very sensitive information."

Privacy first

Angus asked Aboriginal Affairs Minister Bernard Valcourt about the possible breach of privacy during question period in Ottawa on Tuesday.

"There are now reports that medical records and case summaries of survivors abused in the residential school system were stolen and that the person who has stolen this information has threatened to go public with it," Angus said.

"When was the the privacy commissioner informed of this breach and what steps have been taken to inform each and every one of those survivors that their personal histories have been stolen under the government's watch?"

Valcourt said his office contacted the privacy watchdog on Monday, "when we were made aware of the allegation."

The minister said the Secretariat is an independent organization for which the Department of Aboriginal Affairs and Northern Development "is not responsible" for.

A spokesperson for Valcourt told CBC News on Wednesday that the matter should be fully investigated.

"Given that the Chief Adjudicator is independent, we have communicated with him, through our Deputy Minister, and expressed that he should investigate this matter fully," said Andrea Richer, the communications director for Valcourt, in an email.

We will work closely with the Office of the Privacy Commissioner to determine the appropriate course of action, if and when that is necessary, as more information becomes available to us- Michael Tansey, senior communications officer with the IRSAS

Dan Shapiro, a lawyer from Saskatoon, was appointed Chief Adjudicator in July 2013. He had been working as Deputy Chief Adjudicator for the Secretariat since 2007.

Tansey said on Wednesday that no one was immediately available for an interview but that the need to protect the privacy of the claimants and others involved in the claims process was "constantly reinforced with all adjudicators."

"Respecting the privacy of IAP claimants and the details of their claims, is one of the most important aspects of our work at the Indian Residential Schools Adjudication Secretariat."

"We will work closely with the Office of the Privacy Commissioner to determine the appropriate course of action, if and when that is necessary, as more information becomes available to us," Tansay said.

Both Valcourt and Tansay will be attending the final event of the Truth and Reconciliation Commission in Edmonton on Thursday.