Social Services Minister Lisa MacLeod is calling for disciplinary action at the Ontario Disability Support Program, after a personal data breach affected thousands of clients in December.
The ministry mailed out letters to 45,000 ODSP clients late last week warning them about an “error” made by the program’s Mississauga office which saw sensitive information being distributed.
According to the ministry, a spreadsheet, containing names, client identification numbers and email addresses, was "inadvertently" attached to an email sent to 100 ODSP clients.
“Your information was included in the attachment. No personal financial information or home addresses were shared,” the letter read. The ministry also noted to CTV News Toronto that social insurance numbers were not included in the spreadsheet.
Douglas Quantz says he became “enraged” when he opened the letter on Monday, adding that he felt as if he had been robbed of personal information.
“It knocked the wind out of me, quite literally,” Quantz told CTV News Toronto.
“It was a shock.”
MacLeod says while the breach is significant, the ministry has taken “aggressive and decisive” action including informing those affected, contacting the recipients of the spreadsheet and launching an investigation.
She says there should be “some sort of disciplinary action” taken on the advice of the Information Privacy Commissioner, who is investigating the breach.
Response was delayed
MacLeod is also raising issues of information sharing and urgency within her own ministry. She tells CTV News Toronto that it took nearly a week for her to be alerted about the data breach.
The breach took place on Dec. 20, but MacLeod says she was informed a few days after Christmas and initiated an immediate response.
“I think that’s unacceptable,” MacLeod told CTV News Toronto.
“I indicated to ministry officials when there’s a breach like this in the future, that I am notified right away.”
Quantz is also questioning why he wasn’t informed sooner by phone or email, and instead received a letter more than a month after the breach took place.
His concerns are being echoed by NDP MPP Lisa Gretzky, who says some clients have yet to receive a letter and have been learning about the breach on social media.
“They have their email addresses, they have their phone numbers. They could have reached out to let them know the information was shared and what they’re doing to try and correct the problem," Gretzky said.
MacLeod agrees.
“This is a problem as well. (Those affected) should have been notified immediately. That’s something the ministry is going to have to do a better job of," she said.
Containing the breach could be difficult
Of the 100 people who received the excel spreadsheet, ministry officials say 75 have been contacted and agreed to delete the email and attachment.
However, MacLeod could offer no guarantees that recipients actually deleted the emails calling that part of the “big issue” with the breach.
The ministry has not been able to contact the remaining 25 OSDP clients who now possesses the private information.
“That’s why we’re recommencing to call people, to email them and to try and get them to make those deletions,” MacLeod said.
“It is the unknown that has me worried and stressed,” an ODSP recipient, who wished to remain anonymous, told CTV News Toronto on Monday.
“I wouldn’t know what to do with somebody’s information … but there are people out there who do know how to use that to make money. Just because I don’t know how to do it, doesn’t mean there isn’t somebody else that knows how to do it.”
What happens next
MacLeod says she “expects more” from civil servants within her ministry and is working with the Ontario Public Service to ensure systems and programs are in place to avoid another breach.
The minister says that includes modernizing the digital infrastructure within the ministry to ensure sensitive client information isn’t stored on excel spreadsheets. MacLeod notes those upgrades are already underway.
Quantz says he was told it wasn’t necessary to change his client number, despite his request to do so.
Meanwhile, he wants to see more than an apology. He wants MacLeod to take personal responsibility for the breach.
“The buck stops with her.”
