Class action lawsuit filed in student loans privacy case

A class action lawsuit against the government has been launched following a security breach involving student loans.

A Newfoundland lawyer has filed a class-action lawsuit after a federal agency lost the personal information of more than half a million people who have student loans.

The information was lost on a portable hard drive that contained files for 583,000 people who held student loans from 2000 to 2006, according to assistant privacy commissioner Chantal Bernier.

St. John's-based lawyer Bob Buckingham believes the number of people affected is closer to two million, however, and has filed the suit on behalf of anyone whose personal information may have been compromised.

Another law firm, the Merchant Law Group, says it is filing for similar class actions in Calgary and Winnipeg.

Any such lawsuits would have to be certified by a court before they could move forward.

Meanwhile, Bernier said her office may audit select government departments that have large volumes of sensitive data after conducting an investigation into the loss of the portable hard drive.

Human Resources and Skills Development Canada said last week that the missing device contains student names, social insurance numbers, birth dates, loan balances and contact details, but not the borrowers’ banking information. Personal contact information of 250 department employees was also on the hard drive.

Student-loan borrowers from Quebec, Nunavut and the Northwest Territories are not affected.

The RCMP is also looking into the matter.

In an interview with CTV Atlantic, Bernier said she hopes the hard drive has not fallen into the wrong hands.

“That is what everyone hopes, of course,” she said.

She said a possible audit of other government departments will look at how sensitive data is stored on portable hard drives, USB keys and mobile devices.

“Do they have the right policies to ensure their safety? That’s another angle to look at the systemic issues at hand here,” Bernier said.

Bernier said the national privacy watchdog is trying to determine “exactly what happened and why it happened” when the hard drive went missing from HRSDC’s Gatineau, Que. office.

Even when strict data-storage policies are in place, human error is the main cause of privacy breaches, she said.

Bernier said it’s difficult to assess the risk to affected student-loan borrowers because no one knows what happened to the data.

“We don’t know where that hard drive is. Is it in the wrong hands, or is it just in the wrong place? So when we have more on that, then we’ll be able to see exactly the risk that’s been created.”

Human Resources Minister Diane Finley has called the privacy breach “serious” and “unacceptable.”

She requested last week that all departmental employees participate in mandatory training on a new security policy, which bans portable hard drives and unapproved USB keys.

HRSDC said it will send out letters to all those affected -- if the department has their current contact information.

Others can call a toll-free number, 1-866-885-1866 (or 1-416-572-1113 for those outside North America) to find out if their files were on the missing hard drive.