A box of documents, labeled as "Material for Shredding" was left in front of a recycling bin at a Thunder Bay landfill. In the box were documents related to student loan applicants, including social insurance numbers, financial statements and other sensitive information. The Information and Privacy Commissioner of Ontario has begun an investigation:

Privacy botched: Copies of OSAP documents land at dump (Thunder Bay Chronicle-Journal):

"By Stephanie MacLellan - The Chronicle-Journal

April 21, 2005

The Ontario privacy commissioner’s office is investigating after confidential information from the Thunder Bay office that runs Ontario’s student loan program turned up in the John Street landfill Tuesday.

Some papers found in the landfill listed social insurance numbers, income information and home addresses for Ontario Student Assistance Program applicants.

Four boxes from the student support branch of the Ministry of Training, Colleges and Universities, located in the Ontario government building on Red River Road, were discovered by a custodian Tuesday at about 3:30 p.m. They were stacked in front of a paper recycling bin at the landfill.

The boxes were labelled, “Material for shredding,” but the papers were intact. The boxes have been retrieved and the Office of the Information and Privacy Commissioner has launched an investigation, said office spokesman Bob Spence.

“We look into what did happen and make a series of recommendations,” he said Wednesday.

Charges won’t be laid unless it’s shown someone intentionally violated the Freedom of Information and Protection of Privacy Act, he said.

The student support office runs the provincial student loan program, known as OSAP. Two boxes contained “garbage,” and the other two held filed copies of correspondence between staff and OSAP applicants that included personal information, ministry spokeswoman Linda Nicolson said.

“Those were not the original documents, but the working copies the staff works with,” she said.

Those copies were to be shredded before they were thrown out, she said.

She said it wasn’t clear what was included in the “garbage” boxes, or how long the boxes sat in the landfill.

Office staff notified the ministry after the boxes were found, and the ministry immediately contacted the privacy office, Nicolson said. The ministry has also launched its own investigation into the incident.

“We want to make sure that we’re following the best practices, in terms of the records that are kept in the OSAP office,” she said. “We want to make sure that this doesn’t happen again, and that we do whatever we have to do to ensure that.”

Documents that arrive at the student support office are scanned into a computer imaging system, with the paper copies stored for six months, Nicolson said. After that, they are transferred to a government records storage facility, where they are stored for 20 years, then destroyed.

Reino Viitala, a custodian at a Thunder bay seniors’ home, discovered the boxes Tuesday afternoon when he made his weekly stop at the landfill. They drew his attention because they were sitting in front of a paper recycling bin, which was overflowing.

He was hoping to reuse the file boxes, until he realized they contained personal information.

“Social insurance numbers, addresses, names, financial statements, the whole bit,” he said. “I was concerned. . . . I know how sensitive that information is.”

He said one of the boxes was partially open and papers were escaping.

Viitala called the phone number on one of the forms and reached the student support office. He reported the boxes and waited at the landfill for over an hour until someone showed up to collect them, he said. He left after he helped her load the boxes into an SUV.

Spence said there is a danger of identity theft if this kind of information ends up in the wrong hands.

“Identity theft rarely happens, but it can happen, and that’s one of the reasons care has to be taken in the destruction of records,” he said."

Hmm. Not sure if identity theft "rarely happens"...

Labels: identity theft, information breaches, ontario