Sask. breached privacy by mailing 415 tax slips to wrong people: commissioner

Saskatchewan's Ministry of Advanced Education caused a privacy breach last year when it mailed out 415 tax slips to the wrong people, according to the office of the province's information and privacy commissioner.

Along with confirming the privacy breach, the commissioner's office found the province's response to be "inadequate."

The commissioner found the province did not properly inform those affected about potential risks from the privacy breach and failed to offer credit monitoring.

"The circumstances here weigh in favour of a recommendation that credit monitoring be offered," the report reads.

The breach happened in February 2024 when an employee with the Ministry of Advanced Education responsible for producing mailing labels made a mistake when working on an Excel spreadsheet.

The "senior employee" was not aware of configuration changes in the software and as a result the printed labels had the incorrect address, according to the report.

That meant 415 "Statement of Pension, Retirement, Annuity, and Other Income" forms, better known as T4A slips, went to the wrong people.

Due to some people receiving more than one T4A slip, the breach only affected 277 people.

According to the commissioner's report, the slips contained private information such as social insurance numbers, financial information and potential details about whether an individual had a disability.

154 unaccounted T4A slips

Officials with the ministry acted appropriately to contain the breach once it was discovered, according to the report. However, 154 T4A slips affecting 121 people remain unaccounted for.

While the ministry notified everyone affected by the breach, it failed to include a description of the possible types of harm or advice on what actions could be taken.

The commissioner's office recommended that the ministry update its forms so that any future notifications of a privacy breach provide victims with the best information possible.

The report says the ministry is already working on eliminating paper and mailing within its tax slip process. That should be in place by fall 2025.

Officials also failed to offer affected people credit monitoring — a key response when the privacy information disclosed includes something like a social insurance number, according to the privacy commissioner.

The commissioner recommended those affected by the breach be offered credit monitoring within 30 days.