Bitter about delay
The government's failure to notify him of a data breach has local man fuming
Chilliwack resident Mike Zonta spent hours on the phone with credit monitoring agencies after he learned his personal data was on a hard drive that went missing from an HRSDC office.
Photograph by: Paul J. Henderson , TIMES
If Mike Zonta's monthly mortgage-sized student loan payments weren't enough of a stressor, finding out that his personal information may have been stolen is a further burden.
Zonta is one of 583,000 Canada Student Loans Program borrowers whose personal information-social insurance numbers (SIN), dates of birth, addresses-were on a hard drive that went missing from a Human Resources and Skills Development (HRSDC) office in Quebec nearly three months ago.
"I am in awe, that given the time frames, the government is projecting such a nonchalant attitude towards jeopardizing individuals information," Zonta told the Times. "With SIN numbers, dates of birth, etc., criminals could wreak havoc and destroy a victim's life. Although it hasn't been confirmed that the drive has been stolen, the potential is there and the government has not responded appropriately."
The hard drive was discovered to be missing by an HRSDC employee on Nov. 5, 2012. An HRSDC press release said after this that "search efforts began."
Twenty-three days later security was notified and on Dec. 6 it was discovered the hard drive contained the data of 583,000 student loan borrowers and 250 HRSDC employees.
The Office of the Privacy Commissioner was notified on Dec. 14 and on Jan. 7 the incident was reported to the RCMP. The government issued a press release about the data loss on Jan. 11 but the individuals whose personal information was on the hard drive were not told.
If Zonta didn't have a friend whose sister was a CBC reporter, prompting him to do some research online, he said he still likely wouldn't know.
"They told me I'd be getting a letter," Zonta told the Times on Jan. 27. "I still haven't received that letter."
Once he found out about the breach, Zonta called the toll-free number the government set up to confirm that his data was on the missing hard drive.
He then spent more than two hours on hold with credit monitoring services TransUnion and Equifax to flag his credit information.
Diane Finley, the minister responsible for HRSDC, issued a public apology on Jan. 11 for the incident and on Jan. 25 the ministry announced the government had signed a deal with Equifax to "provide the affected clients with credit and identity protection services for a period of up to six years."
The ministry will pay for a "credit flag" but even this isn't as much as might be required. Equifax spokesperson Tom Carroll told the CBC
that a credit flag forces the bank to look into who might be applying for credit in your name, but he added that is not the same as the $15-a-month credit monitoring that HRSDC had suggested the borrowers should buy.
For Zonta, the credit monitoring is the least the government can do given the breach of security. He thinks they should go further and reissue social insurance numbers.
Zonta still has a number of questions that so far no one has answered. Foremost, he wonders why it took so long to notify the public about the security breach.
"It has been over a month and they never actually notified the individuals affected," Zonta said. "What sort of environment is this information being stored in, where in over a month they still cannot confirm that it has left the building?"
Zonta was already bitter about the government making money with the interest he and his wife pay on their student loans.
"The thing that irks me the most is that they could have used 2.5 per cent interest above prime from my loans to invest in a proper security system to protect my private information," he said.
At least one class action lawsuit has been launched related to the security breach by a Newfoundland lawyer and more are likely across the country.
Zonta said he will join any class action lawsuit.
The toll-free number set up by HRSDC for individuals to verify if they are affected by this incident is 1-866-885-1866. Hours of operation are 8 a.m. to 8 p.m. (EST), seven days a week.
In unrelated news, the BC Government issued a press release Monday as Jan. 28 is the annual Data Privacy Day. "In Canada, this year's theme is 'Take control of your information, don't let it come back to haunt you'-a theme that reflects our collective responsibility to understand how changes in technology affect our privacy rights," B.C. Information and Privacy Commissioner Elizabeth Denham said in the release.
