Mechanical malfunction, compounded by human error, leads to data spill
In March 2009, the Quebec processing centre of Human Resources and Skills Development Canada mailed 11,900 forms to applicants for the Guaranteed Income Supplement. Due to a mechanical breakdown in the machine used to print, fold and insert correspondence into envelopes for mass mailings, some people received forms destined for other people, along with their own.
Forty-four cases of the mix-up were reported to the department.
According to our investigation, the forms contained the names of applicants for the supplement (and their spouse, where applicable), addresses, and Social Insurance Numbers, although the SINs were inverted and given an additional code in order to make them difficult to identify. No benefit information was disclosed.
We also determined that human error played a role. The technician overseeing the mass mailing noticed at the outset that some forms were being folded and inserted in duplicate into envelopes. He recalibrated some equipment settings and allowed the job to continue. He did not make use of mechanisms to detect duplicate documents, and did not notify managers of the errors.
The department became aware of the incident when call centre agents began receiving calls from affected individuals. The institution notified our Office in April and the Commissioner initiated a complaint in June.
Following an investigation, the complaint was determined to have been well founded.
Human Resources and Skills Development Canada, which conducted its own investigation into the incident, took steps to improve the functioning of its mailing equipment and to review and strengthen its quality-control procedures.
Because of the technician’s silence, our Office further underscored the role that human error had played in compounding the problems created by the mechanical defect. Accordingly, we recommended that the department better sensitize employees to their obligations to safeguard personal information. The department undertook to update its employees’ knowledge of the Privacy Act and related policies and procedures.
- Date modified: