Investigation into Desjardins’ compliance with PIPEDA following a breach of personal information between 2017 and 2019

PIPEDA Findings #2020-005

December 14, 2020

---

Overview

1. On May 27, 2019, the Fédération des caisses Desjardins du Québec (“Desjardins”) notified the Office of the Privacy Commissioner of Canada (“our Office” or the “OPC”) of a breach of security safeguards that ultimately affected close to 9.7 million individuals in Canada and abroad. The compromised personal information included first and last names, dates of birth, social insurance numbers, residential addresses, telephone numbers, email addresses and transaction histories. The number of individuals affected includes individuals whose personal information a malicious employee was able to access and/or exfiltrate.
2. Desjardins also informed Quebec’s Commission de l’accès à l’information (the “CAI”) and other regulators of the fact that there were individuals within their jurisdictions that were affected by the incident.
3. The OPC and the CAI launched investigations into this matter. To coordinate their efforts, the two Offices signed a collaboration arrangement on July 25, 2019.
4. Desjardins concluded that the breach had been committed by one of its employees, who had been exfiltrating personal information over a period of at least 26 months. This raises the question as to whether Desjardins’ security safeguards were appropriate and whether it met accountability requirements with respect to the personal information entrusted to it. Given the age of some of the information compromised in the incident, the OPC also reviewed Desjardins’ data destruction practices.
5. Our investigation concluded that Desjardins contravened the Personal Information Protection and Electronic Documents Act (“PIPEDA”)’s principles with regard to accountability, retention periods, and security safeguards. This report contains recommendations to Desjardins to address the contraventions found.

Background and scope

6. Twelve individuals whose personal information was compromised in the incident filed complaints against Desjardins with our Office. The complainants alleged that Desjardins had not sufficiently protected their personal information against illicit accesses, nor applied appropriate retention periods.
7. The compromised personal information (first and last names, dates of birth, social insurance numbers, residential addresses, telephone numbers, email addresses and transaction histories) had been collected by Desjardins from its clients and members who purchased or received products offered directly or indirectly by the organization. The affected personal information varied depending on the product or service received and whether it related to a current or former client/member. These personal identifiers combined, present a real risk of unauthorized use by malicious actors for identity theft. This risk is enduring because these identifiers are often used for identity validation and are relatively permanent.
8. A Desjardins member is an individual or company holding a share in a Desjardins credit union affiliated with the Fédération des caisses Desjardins du Québec or the Fédération des caisses populaires de l'Ontario. A Desjardins client is an individual or company doing business with an entity affiliated with Desjardins without necessarily being a member.
9. The compromised personal information was originally stored in two Desjardins data warehouses, the credit data warehouse and the banking data warehouse. Access to the latter was segmented according to whether the information was confidential (which included personal information) or non-confidential. The credit data warehouse was not segmented, and employees with the necessary authorizations could access all of the data, including personal information.
10. Our investigation revealed that in the course of fulfilling their duties, certain employees from Desjardins’ marketing department copied the compromised personal information from both data warehouses to the marketing department’s shared directory accessible to all employees of the department. These employees had the necessary authorizations to access the data warehouses, including confidential information (and personal information). The employee identified by Desjardins as the source of the breach, referred to in this report as the ‘malicious employee’, did not have access rights to personal information held in the banking data warehouse. However, he did have access to other non confidential information contained in this warehouse.
11. More precisely with respect to the above, each month one or more employees performed an automated transfer of personal information from the credit data warehouse to their user folder(s) in the marketing department’s shared drive. Other employees in the marketing department copied confidential personal information from the banking data warehouse to a shared drive. Once transferred, employees who did not have the necessary authorizations to access the confidential information in the data warehouses were able to access it freely.
12. Between March 2017 and May 2019, the malicious employee copied this personal information from the shared drive, including information he would not normally have access rights to in the banking data warehouse, onto his work computer and then onto USB keys. This was in contravention of the confidentiality agreement he signed in the course of his employment.
13. According to various media reports, the malicious employee is suspected of having sold some of the personal information to a private lender. Some of the information was reportedly then forwarded to a second private lender, who was also a mortgage broker, and his partner, an investment and insurance advisor^{Footnote 1}. This partner allegedly admitted to investigators from the Autorité des marchés financiers that he paid $40,000 to buy lists of Desjardins members’ personal information^{Footnote 2}. As of the completion of this report, the police authorities were still conducting their investigation into the Desjardins Breach.
14. In light of these background facts, this report considers the following issues.

Issues

15. Issue 1. Given the failure of security safeguards in this breach, was personal information held by Desjardins protected throughout its life cycle by security safeguards appropriate to the sensitivity of the information as required by PIPEDA Safeguards Principle 4.7? Also, did Desjardins fulfill its responsibilities to implement procedures to protect the personal information and train its staff, as set out in Accountability Principle 4.1?
16. Issue 2. Given the age of some of the personal information in question, was the personal information of individuals handled in accordance with the retention and destruction requirements as set out in PIPEDA Principle 4.5, limiting use, disclosure and retention?
17. Issue 3. Given that the compromised information presents an ongoing risk of harm for those affected, were the mitigation measures offered by Desjardins to affected individuals adequate to protect their personal information from unauthorized use, such as future identity theft, in accordance with PIPEDA Safeguards Principle 4.7?

Jurisdiction

18. Desjardins operates mainly in Quebec, but also conducts activities in other Canadian provinces and abroad. Desjardins is subject to both An Act Respecting the Protection of Personal Information in the Private Sector in Quebec and the federal law, PIPEDA. PIPEDA applies in respect of Desjardins’ activities in provinces without legislation considered to be substantially similar to PIPEDA. PIPEDA also applies where there is an interprovincial or international flow of personal information in the course of Desjardins’ commercial activities. Some of the personal information compromised by the breach was collected by Desjardins in the course of its activities outside Quebec but was stored in that province.

Cooperation agreement between the OPC and the CAI

19. The OPC and the CAI launched investigations into this matter. To coordinate efforts, the two Offices signed a collaboration arrangement on July 25, 2019. Throughout the investigation, the OPC and the CAI exchanged relevant information, worked together to identify required information and documentation, and jointly prepared for and conducted various interviews and a site visit at Desjardins’ office.

Methodology

20. In reaching our conclusions in this investigation, we consulted various open sources and reviewed the information provided by Desjardins through different means, including the following:
    1. written submissions, including those received in response to specific questions from the OPC;
    2. telephone and in-person interviews with key individuals, including a site visit at Desjardins’ office in Montréal on July 16 and 17, 2020;
    3. demonstrations of technological security safeguards during our site visit at Desjardins’ office;^{Footnote 3}
    4. a sample of the compromised data types;
    5. copies of documents relevant to the file:
       • the organization’s relevant policies and directives
       • security standards and risk analysis reports
       • training materials
       • Desjardins’ organization chart and network diagrams
       • the organization’s code of ethics
    6. corrective measures that it has implemented or intends to implement.
21. We analyzed the technological and organizational security safeguards deployed by Desjardins at the time of the incident. The analysis also covered the methods used by Desjardins to implement its new security program and the anticipated timelines for deployment.
22. We also compared the safeguards implemented by Desjardins with those observed in previous OPC investigations and with the relevant standards and best practices, especially with respect to combatting insider threats.
23. Upon completion of our investigation, we issued a preliminary report of investigation to Desjardins, which set out and explained the rationale for our preliminary conclusions and identified several recommendations. We then met with Desjardins to address any questions or comments they had, and to discuss our recommendations.
24. The OPC cooperated and coordinated with the CAI throughout this investigation.
25. Desjardins cooperated with our Office throughout the investigation and has confirmed its agreement to implement the recommendations of this report.

Issue 1. Desjardins’ security safeguards and its responsibility to implement procedures to protect personal information and train employees

26. Under PIPEDA Principle 4.7, personal information must be protected by security safeguards appropriate to the sensitivity of the information. In our view, this is applicable throughout the entire life cycle of the information. The security safeguards must protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification (4.7.1). The methods of protection should include (4.7.3):
    1. physical measures, for example, locked filing cabinets and restricted access to offices;
    2. organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and
    3. technological measures, for example, the use of passwords and encryption.
27. Under PIPEDA Principle 4.1, an organization is responsible for personal information under its control. As stated by Principle 4.1.4, organizations must implement policies and practices to give effect to PIPEDA principles, including implementing procedures to protect personal information [4.1.4(a)], and training staff and communicating to staff information about the organization’s policies and practices [4.1.4(c)].

Description of the overall architecture

28. The compromised information was held in two data warehouses: the banking data warehouse and the credit data warehouse.
29. To access the information from these two data warehouses, marketing department employees had to use a search and analysis tool accessible through a virtual environment.
30. Desjardins restricted access to the personal information stored in the two data warehouses through specific access rights, including within the marketing team. However, the technological protection measures in place did not prevent the downloading of files containing personal information from the two data warehouses to shared drives accessible to marketing department employees.
31. Marketing department employees all had access to a shared directory which was separated into various subfolders organized by user or other criteria. There were also folders where access rights were limited to certain employees and designated for the storage download of confidential information.
32. Marketing department employees were also authorized to use file transfer software to copy documents from the shared directory to their work computers.

Text version of Figure 1

Figure 1 : How the breach occurred

• The diagram illustrates the progress of the breach at Desjardins
• On the left side, we have the data warehouses
• On the right side, we have the marketing department virtual environment
• In data warehouses, we find confidential data with limited access. There is also non-confidential data accessible to all employees of the marketing department
• Within the marketing department virtual environment, we find a shared drive that contains a confidential folder and other folders accessible to the entire team
• Data going from the confidential data warehouse with limited access to the confidential folder of the shared directory constitutes normal traffic
• Data that goes from the non-confidential data warehouse accessible to all employees of the marketing department to folders accessible to the entire team in the shared directory constitutes normal traffic
• Data going from the confidential data warehouse with limited access into the folders accessible to the entire team in the shared directory constitutes traffic creating a vulnerability
• Confidential data with limited access that goes from folders accessible by the entire team in the shared directory to the malicious employee’s work computer constitutes traffic creating a vulnerability
• Confidential data with limited access that goes from the malicious employee’s work computer to removable storage devices such as USB drives constitutes traffic creating a vulnerability

How the breach occurred

33. Our investigation revealed that the compromised information was copied by certain Desjardins marketing department employees from the two data warehouses to the marketing department’s shared drive. As mentioned above, these employees had the necessary authorizations to access the confidential information.
34. Each month from January 2016 to June 2018, one or more employees from the marketing department used a manual script to transfer data, including personal information, from the credit data warehouse to their user folder in the shared directory. Desjardins characterized this operation, of which several employees were aware, as being non-compliant with best practices.
35. On September 18, 2017, and November 13, 2018, certain employees of the marketing department copied confidential information, including personal information, from the banking data warehouse to the shared directory. This information was copied into subfolders that were accessible to all the employees in the marketing department. Desjardins also found that these practices were not compliant with its rules. These employees should have copied the protected information into the confidential folder of the marketing department’s shared directory.
36. The malicious employee did not have the necessary authorizations to access the confidential information in the banking data warehouse. By using personal scripts, the malicious employee was able to compile the data saved by his colleagues in the shared directory. The malicious employee then saved this information in his user folder and in another folder of the marketing department’s shared directory.
37. He then used file sharing software to transfer the compiled information to his work computer and then onto USB keys.

Analysis

38. The affected personal information varies depending on the product or service received by the Desjardins member or client. For some, it includes first and last names, dates of birth, social insurance numbers, residential addresses, telephone numbers, email addresses and transaction histories. Such data elements can be considered sensitive on their own. When combined, they can also be exploited by malicious individuals to steal the identities of the persons concerned. Therefore, in accordance with PIPEDA, the security safeguards implemented by Desjardins to protect this personal information should be commensurately high.
39. Prior to 2019, Desjardins invested a significant portion of its overall information security budget to fight against external threats. However, the breach that is the subject of our investigation is internal in nature. These breaches are those that occur as a result of actions taken by people who work within an organization and may compromise the confidentiality, integrity and availability of information held by the entity. They can be intentional or not, and are more difficult to prevent than attacks caused by external threats, in particular because they are the work of technically competent employees who know the company’s systems and security weaknesses, where information is located, and how to circumvent the protective processes in place.
40. There are generally three types of insider threats. The first type is unintentional and non-malicious, such as when an employee downloads a document onto their computer because they are unaware of the existence of policies and procedures prohibiting this act. The second type is intentional but non-malicious, such as when an employee copies personal information to an open shared directory to speed up their work, despite policies and procedures prohibiting this practice. Finally, the third type is intentional and malicious, such as when an employee copies confidential information onto a personal USB key, knowing that this violates existing policies and procedures, doing so for personal gain, revenge or as a form of protest.
41. The investigation revealed that Desjardins is an organization in which a sense of employee belonging is very present, and where there is a climate of trust. It is commendable to have a trusting relationship with employees, but it must also be accompanied by a culture that adopts verification and control measures. Although the organization had implemented certain measures to deal with an insider threat, we found that it did not have all the necessary measures in place to detect the scheme carried out by a malicious individual who, according to Desjardins, was a skilled and high performing employee, and who was a key resource for many of his colleagues. In our view, the absence of a culture of vigilance against internal threats significantly contributed to the breach.
42. Several measures can be taken to combat insider threats. For our analysis in this case, we focused on the five elements below. We consider them particularly relevant to the breach that occurred at Desjardins:
    1. Security screening and confidentiality agreements
    2. Organizational policies and procedures
    3. Employee training and awareness
    4. Access controls and data segregation
    5. Oversight and monitoring

Security screening and confidentiality agreements

43. Security screenings are the first line of defence against insider threats and are considered an organizational protective measure (see Principle 4.7.3 (b) under PIPEDA). It allows the organization to identify job candidates or employees with suspicious backgrounds or conduct that make them unsuitable to be given access to certain resources.
44. At the time of the breach, Desjardins was conducting security screenings^{Footnote 4} before hiring employees or when transferring them to a new position. For employees in designated positions, security clearances are renewed every five years.
45. Desjardins stated that its security division had conducted a security check on the malicious employee prior to his hiring. The screening raised no concerns. After he was hired, the employee signed a code of conduct attestation on an annual basis. He also signed a confidentiality agreement specific to his duties.
46. The OPC found that Desjardins’ security screenings are acceptable and consistent with currently recognized standards and practices.^{Footnote 5} While security screenings are necessary, they are insufficient on their own to combat insider threats. Additional security safeguards are required, such as policies, training and control measures.

Organizational policies and procedures

47. According to PIPEDA Safeguards Principle 4.7.3, methods to protect personal information should include physical, organizational and technological measures.
48. Policies and procedures are pillars of privacy protection and constitute important organizational measures for protecting personal information throughout its life cycle. They define the organization’s strategy, its expectations of its employees, and its various roles and responsibilities for combatting identified threats. Accordingly, having and implementing adequate policies and procedures in itself constitutes a safeguard. These documents form part of the tools that employees need to fully assume responsibility for the protection of personal information.
49. Under the PIPEDA’s Accountability Principle, an organization is required to implement procedures to protect personal information [4.1.4(a)]. To be effective, security policies and practices must be applied appropriately and consistently. In our view, an organization should be able to verify whether its employees are following them.
50. Desjardins had a large number of directives, policies and procedures for the protection of personal information:
    1. Règle Mouvement sur la gestion des Identités et des Accès [Desjardins identity and access management rules]
    2. Directive Mouvement de Sécurité des technologies de l’information [Desjardins security of information technology directive]
    3. Directive Mouvement sur l’utilisation acceptable des technologies [Desjardins directive on the acceptable use of technology] (Version 1: August 2013, revised in October 2018)
    4. Directive Mouvement sur la gestion des documents [Desjardins directive on document management]
    5. Standard de Sécurité sur l’utilisation de données confidentielles ou secrètes hors des environnements de production [Security standards on the use of confidential or secret information outside of production environments]
    6. Standard de Sécurité des postes de travail [Security standards for work stations]
    7. Standard de Sécurité sur la Sauvegarde de l’information et sur la Gestion des supports de sauvegarde [Security standards for information backup and backup storage media management]
    8. Standard de Sécurité sur la gestion des accès logiques [Security standards for the management of access rights]
    9. Standard de sécurité sur la surveillance et journalisation [Security standards for monitoring and logging]
    10. Politique Mouvement de Sécurité de l’Information [Desjardins information security policy]
    11. Politique sur la protection des renseignements personnels [Personal information protection policy]
    12. Code d’Utilisations entrepôt de données bancaires [Code governing the use of the banking data warehouse]
    13. Code de Déontologie [Code of ethics]
51. Certain relevant policies and procedures were incomplete or had not been implemented. Examples include the personal information retention schedule, standards for managing shared directories, and granting high-level privileges, as well as rules governing the use of confidential personal information extracted from the banking data warehouse.
52. In our view, Desjardins’ most significant failing in this area is with regards to the implementation of its policies and procedures. Despite the existence of many, we identified several examples of Desjardins having failed to take the necessary steps to ensure their complete and integrated implementation. Certain are listed below.
53. Desjardins’ Standard de sécurité sur la protection des données [Security standards for data protection] specifies that only authorized personnel may access, disclose or modify information. It also specifies that confidential information must be protected throughout its life cycle and that all owners of electronic document repositories containing secret or confidential information must ensure that accesses and permissions are managed to ensure confidentiality. Desjardins did not implement safeguards to prevent or control the transfer of confidential personal information from the data warehouse to folders accessible to unauthorized employees and from there to computers and removable storage devices.
54. The Standard Mouvement sur l'utilisation des technologies [Desjardins directive on the use of technology] prohibits the storage of personal information on devices that do not belong to the organization. Despite the existence of this directive, Desjardins' systems did not prevent the use of personal removable storage devices. Desjardins had identified this issue before learning of the breach or how the malicious employee extracted the compromised personal information. Even though Desjardins was in the midst of deploying a solution, which would have ultimately eliminated the use of personal storage devices, it failed to prevent the breach.
55. The Standard de Sécurité sur l'utilisation de données confidentielles ou secrètes hors des environnements de production [Security standards on the use of confidential or secret information outside of production environments] states that transfers of secret data outside of a protected production environment are prohibited unless the data is first removed, masked or replaced by a dataset. It also states that employees must submit a request and have it authorized before transferring any confidential data to a non-production environment. The breach demonstrates that, despite these stipulations, it was possible to transfer confidential personal information out of the protected production environment without masking it or making a transfer request.
56. At the time of the breach, Desjardins had a wide array of directives, policies and procedures for the protection of personal information. However, in several cases, Desjardins failed to adequately implement certain of the directives, policies and procedures it had developed.

Employee training and awareness

57. Organizations must make their employees aware of the importance of maintaining the confidentiality of personal information (PIPEDA Principle 4.7.4). They must also train staff and communicate to staff information about the organization’s policies and practices (Principle 4.1.4(c)).
58. The human factor is the weakest link when it comes to information protection in a technological environment, which is why raising employee awareness is so crucial. It is also key to the implementation and success of information security policies; hence, the importance of training to ensure employees fully understand their roles and responsibilities and how to fulfill them.
59. For the policies and procedures to be implemented effectively, employees must not only be made aware of them but also be able to understand them.
60. Desjardins provides each new employee with about 23 hours of onboarding training, including a 3.75-hour component covering the protection and security of personal information.
61. Desjardins states that it has an ongoing training and awareness program for its employees covering information security and protection of personal information. All employees go through this training. Desjardins also conducts awareness campaigns throughout the year to reiterate key messages and best practices in the protection and security of personal information. It did not, however, provide any indicators demonstrating that its employees understood the content.
62. Also, while many of the malicious employee’s actions were clearly contrary to several of Desjardins’ policies and procedures, it should be noted that employees with legitimate access rights downloaded files to shared sub-folders in the shared drive that was accessible to all marketing employees. These actions constituted non-compliant processing according to Desjardins’ policies and procedures, and did not follow best practices. This raises the question of whether the training provided made them sufficiently aware of the importance of maintaining the confidentiality of personal information, and of the serious consequences of making personal information accessible to unauthorized third parties.
63. In view of the sensitivity of the personal information held by Desjardins and the complexity of the issues related to protecting personal information within such an organization, we found that there were critical gaps in employee training and awareness at the time of the breach.

Access controls and data segregation

64. According to PIPEDA Safeguards Principles 4.7.3 (b) and (c), methods of protection should include organizational and technological measures to protect personal information.
65. Desjardins’ Standard de sécurité sur la protection des données [Security standards for data protection] specifies that only authorized personnel can access, disclose or modify information. It also specifies that confidential information must be protected throughout its life cycle and that all owners of electronic document repositories containing secret or confidential information must ensure that access and permissions are managed to ensure confidentiality.
66. Also, the Règle Mouvement sur la classification de sécurité de l'information [Desjardins information security classification rules], which came into effect on April 22, 2015, and revised on August 28, 2018, states that information must be protected according to its classification so that it remains secure for its entire life cycle, namely, in the course of collection, use, disclosure, retention and destruction.
67. Access to the confidential information in the banking data warehouse was limited to employees with the appropriate authority. Desjardins therefore had policies in place to control and manage access rights and had taken certain steps to implement them.
68. However, Desjardins’ information system allowed authorized users to move restricted data to unprotected directories and storage media without any controls (see paragraphs 10 and 11). Desjardins could have reduced the exposure of the information by substituting it with non-confidential (masked) information, by using, for example, the tokenization technique recommended by its data protection security standards.
69. The personal information of some clients who were not Desjardins members was affected by the breach. In its representations, Desjardins stated that this information ended up in the banking data warehouse in error, without providing any further explanations. We understand from this that Desjardins failed to comply with its own standards governing the segregation of data.
70. The gaps set out in paragraphs 53 and 54 demonstrate that Desjardins did not effectively manage access rights and data segregation, which are important security measures, thereby in contravention of PIPEDA Principle 4.7.

Oversight and monitoring

71. According to PIPEDA Safeguard Principle 4.7.3, security methods for protecting personal information should include physical, organizational and technological measures.
72. Oversight and monitoring are indispensable to any personal information protection system. They can detect suspicious uses of resources and employees’ potential non-compliance with the organization’s directives and policies.
73. In its information technology security standards, Desjardins states that threat detection begins with logging security events, such as system access attempts.^{Footnote 6} These standards also state that an alert system based on event monitoring and correlation must be implemented.^{Footnote 7}
74. Desjardins’ data protection security standards^{Footnote 8} state that, depending on the level of risk, monitoring is required to identify confidential information stored in unauthorized repositories. This can be accomplished, for example, by using a data loss prevention (DLP) solution.
75. A DLP can detect and prevent the potential exfiltration of sensitive data, whether it is in use, in transit or at rest. It is used to combat not only external threats, but also insider threats by preventing employees from transferring sensitive data, intentionally or otherwise. An external firm’s evaluation report on Desjardins’ information security, published in May 2018, stated that Desjardins had partially deployed a DLP solution. In fact, during the breach, Desjardins commenced its deployment. For example, the DLP solution for email monitoring was implemented in 2018, while web filtering capabilities of the DLP were not activated until 2019.
76. In addition to the DLP, several technological approaches may be used to ensure active monitoring of electronic information systems. This proactive approach generates alerts if anomalies are identified in the analysis of the event logs. Desjardins was limiting itself to passive measures such as analyzing event logs only after incidents were reported. In our view, Desjardins could have prevented or minimized the data breach had it optimized the use of these tools. That said, at the time of the breach, Desjardins was in the process of deploying active surveillance measures.
77. The primary function of the Security Information and Event Management (SIEM) system, one of the technological tools for active surveillance, is to correlate and aggregate information from logs from several sources (databases, servers, etc.). The information collected is analyzed in real time. If any departure from the norm is identified, the SIEM generates alerts and initiates actions to combat the potential threat. Before the breach, Desjardins had a SIEM in place; however, it was replaced in June 2019, after the breach was detected, by a superior product.
78. User and entity behaviour analytics (UEBA) is a solution that models user and device behaviours on organizational networks. This enables an organization to identify abnormal behaviour and alert security teams. For example, if a large file is attempted to be downloaded by a user who does not typically do so, the UEBA will generate an alert. At the time of the incident, Desjardins did not have a UEBA solution in place.
79. Before the breach was detected, Desjardins presented the findings of a data loss risk analysis in an internal report prepared for the deployment of a DLP strategy. This analysis led to the conclusion that there was a high risk of data loss via physical vectors such as USB keys. To reduce this risk, this study had recommended measures such as the monitoring of suspicious behaviour and the detection of data exfiltration activities. As explained above, such measures can be implemented using the approaches described in paragraphs 75, 77 and 78 (DLP, SIEM and UEBA).
80. An organization like Desjardins, which handles a large volume of transactions involving sensitive personal information, must have an active monitoring system. This requires technological measures based on approaches, such as those listed above.
81. In addition, the external firm’s report evaluating Desjardins’ information security, published in May 2018, states that Desjardins had partially deployed a DLP solution. Desjardins did not implement all of the recommendations from its own report nor from the external firm’s. Taking advantage of the presence of data copied by his colleagues onto the shared directory and of the absence of mechanisms preventing or controlling the use of USB keys, the malicious employee was able to use removable storage media, precisely one of the scenarios envisioned in Desjardins’ report.
82. Desjardins did not detect the data theft on its own. It was the Laval police department that notified Desjardins after it discovered evidence of the breach in the course of a separate investigation involving the financial institution.

Conclusion

83. For the reasons described above, we are of the view that Desjardins’ protection measures were inadequate in the following four areas:
    1. Organizational policies and procedures
    2. Employee training and awareness
    3. Access controls and data segregation
    4. Oversight and monitoring
84. In our view, the specific weaknesses described above, individually and collectively, constitute failures to implement appropriate security safeguards given the volume and sensitivity of the personal information held by Desjardins. Accordingly, Desjardins is in contravention of PIPEDA Safeguards Principle 4.7.
85. Furthermore, weaknesses related to implementing procedures and training staff represent contraventions relating to the Accountability Principle, in particular PIPEDA Principle 4.1.4.
86. Our recommendations for appropriate measures to remedy this contravention are presented at the end of this report.

Issue 2. Retention of personal information held by Desjardins

87. According to PIPEDA Principle 4.5 (Limiting Use, Disclosure and Retention), an organization must not retain personal information longer than necessary to fulfill the purposes for which it was collected. According to Principle 4.5.3, personal information that is no longer required to fulfill the identified purposes should be destroyed, erased or made anonymous by the organization. Organizations must also develop guidelines and implement procedures to govern the destruction of personal information.
88. As described at paragraph 9 of this report, between January 2016, and November 2018, certain employees downloaded personal information from two data warehouses to the marketing department’s shared drives. This represented the personal information exfiltrated by the malicious employee.
89. Included in the information inappropriately accessed by the malicious employee were 3.9 million inactive files, some of which had been inactive for decades. Given the age of the files, we looked closely at Desjardins’ personal information retention practices.
90. At the time of the breach, Desjardins had a directive (Directive Mouvement sur la Gestion des documents [Desjardins directive on document management]) and a policy (Politique sur la protection des renseignements personnels [Personal information protection policy]) setting out the guiding principles governing the retention of personal information.
91. For example according to its Directive and Policy, personal information must only be retained for as long as necessary to fulfill the purposes for which it was collected, and documents must be retained for an appropriate period, in line with their business, tax, legal and historic value.
92. In 2018, in the midst of the breach, Desjardins was working on its document retention schedule, which has yet to be finalized.
93. Moreover, Desjardins did not have any procedures in place to destroy personal information at the end of its lifecycle.
94. In submissions we received seven months after the incident, Desjardins was still incapable of determining the retention period for the compromised inactive accounts.
95. Retaining personal information longer than necessary risks causing harm to the individuals concerned. It can increase the risk of a potential breach of personal information, such as the one that occurred at Desjardins.
96. In light of the above, we are of the view that Desjardins did not handle personal information in accordance with the retention and destruction requirements set out in PIPEDA Principle 4.5.
97. Our recommendations for appropriate measures to remedy this contravention are presented at the end of this report.

Issue 3. The mitigation measures offered by Desjardins to the affected individuals

98. According to PIPEDA Safeguards Principle 4.7.1 security safeguards must protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.
99. In an investigation report of findings published in 2019 regarding a breach affecting Equifax in 2017, we expressed our view that Principle 4.7.1 requires that organizations take appropriate mitigation measures following a breach to prevent the future unauthorized use of the compromised personal information.^{Footnote 9}
100. In 2018, new PIPEDA provisions regarding organizations’ obligations following a breach came into force.^{Footnote 10} These provisions recognize the importance of mitigation measures following a breach of security safeguards.
101. In the breach that is the subject of this investigation, names, telephone numbers, email addresses, residential addresses and social insurance numbers were among the compromised information for the majority of clients and members affected. As discussed earlier, these personal identifiers, combined, present a real risk of unauthorized use by malicious actors for identify theft. This risk is enduring because these identifiers are often used for the purpose of identity validation, and are relatively permanent.
102. In this context, we considered whether the protection measures offered by Desjardins to those affected provide adequate long-term protection against such unauthorized use of the compromised personal information.
103. Among the measures taken, Desjardins created a website and set up a call centre for its clients to better understand the incident and the associated protection measures.
104. Desjardins directly and indirectly notified affected individuals, providing them with a detailed description of the compromised personal information and the protective measures offered by the organization (including the credit monitoring service provided by Equifax and the Desjardins Protection). The company also offered all of its members using AccèsD unlimited access to their credit records through TransUnion.
105. As a further mitigation measure, the financial institution is providing all of its existing and future members and clients with the Desjardins Protection Plan (Protection/Assistance). The plan has four components. Former clients and members are only eligible for the fourth component:
     1. Asset Protection: Ongoing protection allowing for a full reimbursement of any losses caused by unauthorized transactions in Desjardins client and member accounts.
     2. Reimbursement: Ongoing protection allowing for the reimbursement of any expenses incurred in the identity recovery process. All members can be reimbursed up to $50,000 per event. Additional reimbursements are possible, such as for lost salary or childcare costs connected with any absences required to carry out the necessary steps of the identity recovery process.
     3. Support:^{Footnote 11} Direct rehabilitation assistance in the case of identity theft, including individual support throughout the identity recovery process. The use of these services is unlimited and permanent. The services of experts such as lawyers and psychologists are also available to affected members.
     4. Equifax Credit Monitoring (Prevention/Monitoring) for five years: Daily credit monitoring with alerts of activity or changes to the credit score. The protection also includes permanent insurance of up to $50,000 for identity theft.
106. By offering these mitigation measures to protect those affected against the unauthorized use of their personal information, Desjardins has satisfied its obligations under Principle 4.7. It should be noted that overall, the measures taken by Desjardins significantly surpass those taken by other organizations following a major data breach.
107. Given the measures proposed by Desjardins, we have no recommendations to make on this point.

Steps taken by Desjardins following the breach

108. After the breach, Desjardins took a number of steps to improve the organization’s security. This section presents the principal measures implemented.

Creation of the Desjardins Security Office

109. This office is responsible for coordinating organizational initiatives and instituting integrated, cross-sector security strategies. It is also charged with the protection of the assets and personal information of Desjardins’ members and clients. Finally, it is responsible for establishing a process through which security related issues are reported.

Programme d’amélioration de la sécurité de l’information et de la protection des renseignements personnels [Information Security and Privacy Protection Improvement Program]

110. The purpose of this program is to remedy the organization’s cultural blind spots that facilitated the breach. It arose from an overarching plan involving several measures and actions aimed at improving access controls and rights, monitoring and detecting threats, improving training and awareness, and increasing privacy protections. For example, Desjardins will eliminate personal information in certain databases when its use is no longer required for the business process. It will also replace personal information with less sensitive data.

Security screening

111. For all users with high-level access privileges, security screening and credit check procedures have been revised and will now be renewed every three years. This is the case, for example, for those authorized to access the confidential data in the banking data warehouse.

The organization’s policies and procedures

112. In light of the results of internal audits, Desjardins intends to adjust certain of its policies and directives, including the following:
     1. STD-SEC-06.02 Standard de sécurité sur les postes de travail [Security Standards for Work Stations]
     2. STD-SEC-12.01 Standard de sécurité sur la protection des données [Security Standards for Data Protection]
     3. STD-SEC-12.03 Standard de sécurité sur la sauvegarde [Security Standards for Backup]
     4. STD-SEC-14.01 Standard sur l’utilisation des données confidentielles de production à l’extérieur de l’environnement de production [Standards for the use of Confidential Production Data Outside of the Production Environment]
     5. POS-SEC-2015.04 Sécurité des données de cybermétrie [Security of Cybermetrics Data]
     6. Politique Mouvement sur la protection des renseignements personnels [Policy on the Protection of Personal Information]

Employee training and awareness

113. Desjardins is currently upgrading its security training and awareness program for all of its employees and managers. Desjardins is also developing specific training for employees handling personal information to remind them of their roles and responsibilities.

Access controls and data segregation

114. Desjardins reduced the use of shared directories and extended the blockage of removable storage devices to all business lines in the organization. Desjardins also further segmented the two data warehouses.
115. Desjardins has centralized processes for granting access rights and reduced the number of accounts with high-access privileges. To manage bulk data, it has chosen modern data management business processes to reduce, if not eliminate, human interventions.
116. Desjardins has created a new, restrictive analysis environment to house applications that give access to mass confidential data. This environment controls, restricts and monitors the use and extraction of the data held in the data warehouses.
117. In the course of our investigation, we observed that there was an approval threshold below which small file transfers were permitted without requiring approval. Desjardins has since changed its process. Going forward, this approval process no longer considers the size of the files transferred, but rather focuses on the sensitivity of the information they contain. Desjardins also has procedures and tools in place to control and delete personal information when its presence outside of data warehouses is no longer justified.

Oversight and monitoring

118. Desjardins has accelerated the implementation of a process to evaluate insider threats that pose risks to its operations. It has adopted active surveillance of its employees’ use of technology. For example, Desjardins has installed extensive DLP solutions to monitor all of the main data exfiltration vectors (email, web navigation, copying onto USB keys, etc.). It also relies on a UEBA solution to monitor suspicious user behaviour. Finally, Desjardins has acquired a network directory scanning tool to identify confidential information. Beyond technological measures, Desjardins is applying a holistic approach by amending its processes and augmenting staff training and awareness.

Retention of personal information held by Desjardins

119. Desjardins is currently developing a more detailed retention schedule. This will determine how long each type of data is to be retained, based on relevant requirements. Along with the implementation of the schedule, personal information that has reached the end of its retention period will be destroyed or anonymized.

Conclusion and recommendations

120. While it is commendable for organizations to trust their employees, this must be accompanied by oversight and control measures. A culture of accountability is also essential. The most senior levels of management must be involved, since an organization’s leaders must initiate and adopt cultural change.
121. Furthermore, everyone involved in the handling and protection of personal information must fully perform their roles and responsibilities. This means providing them with the necessary technological resources and training.
122. While it is important to recognize that Desjardins has implemented several significant progressive changes to remedy the gaps identified following the breach, this report contains recommendations to Desjardins to continue to remedy these weaknesses.
123. The breach analyzed in this report highlights the dangers presented by insider threats, intentional or otherwise. The OPC maintains that vigilance and a holistic approach are important when deploying measures to address and mitigate the impact of such threats.
124. As part or our preliminary investigation report, we made the following recommendations to Desjardins with respect to contraventions found under issues 1 and 2 regarding the security safeguards and the retention of personal information:
     1. Provide to the OPC every six months a progress report on actions taken by Desjardins following the breach to safeguard information. This report must clearly indicate, for each module, activity and sub-activity:
        1. the desired objective;
        2. a description of the organizational, contractual and technological measures implemented or to be implemented and how they contribute to the protection of personal information;
        3. the effective or anticipated date for the implementation for each measure;
        4. monitoring and control indicators and tools to assess the effectiveness of the implemented measures;
        5. the review frequency of each measure; and
        6. a description of the residual risks corresponding to the implementation status of each measure and the actions planned to address these risks.
     2. Finalize and submit a retention schedule and destruction process within six months of the release of this report, explaining the rationale behind the minimum and maximum periods identified.
     3. Within six months of finalizing the schedule, delete or anonymize any personal information for which the retention period has expired.
     4. Demonstrate to the OPC within six months that requests for access and transfer of personal information are monitored when they involve volumes below the minimum threshold of the new analysis environment.
     5. Demonstrate to the OPC within six months that Desjardins has implemented measures to protect personal information throughout its life cycle, including additional protection to prevent breaches arising from the presence of personal information on employees’ computers following authorized transfers.
125. We also recommended that Desjardins retain the services of an accredited and experienced external auditing firm to assess and certify its information security and privacy program and submit a report of this audit to the OPC within two years. At a minimum, the report must:
     1. assess the security safeguards, policies and procedures and determine their effectiveness for preventing a similar breach in the future;
     2. evaluate the governance system and the organization of the protection of personal information;
     3. assess the resources (human, technological, etc.) allocated to privacy protection;
     4. identify and document the platforms used by Desjardins to store personal information (data warehouses, servers, fixed and removable storage devices, etc.) and identify any sensitive personal information stored in each location (financial information, government identification, etc.);
     5. assess the effectiveness of Desjardins’ safeguards in its storage of personal information in light of the degree of sensitivity of the information;
     6. identify, analyze and document any internal and external risks that could potentially affect personal information in conjunction with any platform, system or process that could lead to the loss, theft, unauthorized access, disclosure, copying, malicious use, modification or any other possible compromise of the information; and assess whether the physical, organizational and technological measures are sufficient to protect against the identified risks;
     7. assess Desjardins’ training program and all associated policies and procedures to ensure that the employees (including technical personnel) understand how to handle personal information, identify and respond to potential breaches, and generally ensure that the personnel is aware of the importance of protecting personal information;
     8. audit the practices for the retention, destruction or de-identification of personal information for which the retention period has expired based on Desjardins’ retention schedule;
     9. identify any recommendations or protection measures proposed by the external auditing firm to improve Desjardins’ information security program and ensure that it complies with the Act; and
     10. identify any internal or external residual risk to the protection of personal information and solutions to address it.
126. In connection with the audit report mentioned at paragraph 125, Desjardins must provide a detailed explanation of its decision to accept or reject the recommendations of the audit report, including a schedule for implementing the recommendations if they are accepted.

Desjardins’ Response

127. Desjardins accepted all of our recommendations and has already put in place certain of the recommendations presented in our preliminary report of investigation.
128. Regarding our recommendations at paragraph 124 b) and c) on the retention schedule and the destruction of personal data, Desjardins proposes a plan spanning 18 months. Once its retention schedule is finalized in early 2021, Desjardins intends to implement the destruction of personal information in three stages of approximately 6 months each, starting with the systems holding the most sensitive data. The project is to be completed by June 2022.
129. Regarding our recommendations at paragraph 124 d) and e) on the monitoring requests for access and transfer of personal information independently of their size, and the protection of personal information throughout its life cycle, Desjardins has already put in place measures addressing these issues.

Conclusion

130. In view of all the above, we consider the complaints to be well-founded and conditionally resolved.
131. The OPC will monitor Desjardins’ progress on its implementation of our recommendations.