Statistics Canada loses, mishandles hundreds of sensitive census, employment files

The federal agency in charge of collecting, analyzing and securely storing personal data about Canadians lost hundreds of sensitive files during the 2016 census process.

Incident reports obtained by CBC News through Access to Information detail 20 cases of information and privacy breaches by Statistics Canada, including long and short census surveys, home visit logs and personal employment records.

Some confidential documents were left on a subway or sent to the wrong home. Hundreds more were lost in a stolen car.

In that latter case, 587 long-form census forms filled out by First Nations residents were stored in the trunk of an employee's vehicle that was stolen when he took a weekend trip to Montreal. The incident report does not specify the enumeration district.

The theft was reported to police and municipal officials, but despite frantic searches to recover the documents in recycling and garbage bins, they were never found.

According to the incident report, police believe the stolen vehicle was quickly chopped up for parts and suggest the documents could have been destroyed.

Statistics Canada concluded the privacy breach was not a "material" one because the thief was targeting the vehicle, not the boxes of census documents. The Privacy Commissioner of Canada was not informed of the incident.

While the documents show there was no immediate effort to reach out to those individuals whose privacy was breached, a spokesman for the agency said they were told what happened during a second census.

"The incident was discussed with community leaders, who supported the re-enumeration of their community. During the re-enumeration, the canvassers informed respondents of the incident," said Guillaume​ Bérubé in an email. "The re-enumeration was successful and the data from the new questionnaires were incorporated into the census results."

Other reports detail privacy breaches on two Alberta First Nations reserves (Enoch and Stoney), when forms went missing or were sent to the wrong addresses. In the Stoney incident, Statistics Canada failed to account for 11 long-form questionnaires.

"There is confidential respondent information on these census forms, and it could be viewed by persons not employed by Statistics Canada and used for malicious purposes," the Statistics Canada incident report warns.

Damage to reputation

"Other possible risks include: perception that Statistics Canada does not protect respondent data, and the possibility of not obtaining this information again from these respondents."

Bérubé said the individuals in that case were not notified because Statistics Canada determined that there was "no reasonable expectation of serious risk to the individuals concerned."

In other cases where census surveys were lost or sent by mistake to the wrong addresses, those affected were informed, provided with explanations and apologies and, in some cases, advised of their right to complain to the Privacy Commissioner.

But in the cases involving the Enoch and Stoney reserves, a decision was made not to notify the respondents about the privacy breaches. The incident reports suggest staff felt those already reluctant to take part in the census might be even more wary after learning about the loss of personal information.

"If we lost their information, we may not be able to gather this information again," one incident report says.

"We are still in collection on this reserve. At this point, we will not be advising respondents and we will not be re-collecting this information based on direction received from the field operations project team."

Former federal privacy commissioner Chantal Bernier said StatsCan has a strong track record on ethics and security safeguards, but these incidents highlight a need for greater transparency and accountability.

Understanding that the agency may have a strategic objective in collecting information on reserves, she said, there must always be a clear explanation for why people are, or are not, informed of a privacy breach involving their personal information.

"I feel that StatsCan should ask itself whether indeed it does have, wittingly or unwittingly, a double standard as relates to First Nations," she said.

Gust of wind takes papers

Other breaches cited in the documents include:

• An enumerator leaving a bag on a Toronto subway with grid card access, training manuals and forms with addresses and other personal information. It was never recovered.
• A StatsCan employee losing 16 pages of an assignment list, blown away by a gust of wind in Crossfield, Alta. It included names, addresses and phone numbers but no other identifying information.
• One StatsCan enumerator bringing along a non-employee who had not taken an oath of secrecy, yet was privy to the collection of personal information.
• A job recruiter emailing a request for fingerprints and other information to the wrong candidates.
• An enumerator setting down a bag in front of a six-plex in Toronto while visiting an apartment at the rear of the building. It was gone when the enumerator returned and was never recovered.
• A lost visitation record book with "remarks" that could affect 304 people.
• Job candidates' information being breached when census recruitment envelopes were misplaced. The sheets included selected answers, scores and declarations of past criminal convictions. The agency believes they were misfiled and destroyed in error, but the Privacy Commissioner and Treasury Board Secretariat were advised of the breach.

According to Statistics Canada's website, the agency is required by law to protect the confidentiality of the information respondents provide on its surveys and censuses. When hired, employees are screened for reliability and made aware of the confidential nature of the materials they will be handling. Enumerators must take an oath of secrecy.

Bérubé said protecting respondent and employee personal information is "of utmost importance" and the agency takes any potential breach extremely seriously. 

The Office of the Privacy Commissioner of Canada confirmed it has not investigated any complaints related to privacy breaches involving the 2016 census. The office considers privacy breaches to be unauthorized access to, or disclosure of, personal information, including personal information that is stolen, lost or mistakenly shared.

A privacy breach also may be a consequence of faulty business procedures or operational breakdowns, according to privacy commissioner spokeswoman Tobi Cohen.

For the 2016 census, StatsCan had about 35,000 positions available across Canada, including 25,000 enumerators, 4,000 crew leaders and crew leader assistants and 6,000 other positions.