The federal government waited too long to tell more than 500,000 Canadian students that a hard drive containing detailed personal information had gone missing, a local information ethics and privacy expert says.

Mary Brabston, an associate professor of management and information systems at the University of Manitoba with expertise in issues of information ethics and privacy, says she’s unimpressed with the federal government’s two-month delay in announcing the loss.

“A good management philosophy is that bad news should travel faster than good news,” she said.

“This is so you can quickly solve any problems and get the information out to the affected people.”

On Jan. 11, Human Resources and Skills Development Canada reported a portable hard drive containing personal information of 583,000 students went missing from a HRSDC office in Gatineau, Que.

Missing since early November, the drive contained the first names, social insurance numbers, dates of birth, contact information and loan balances of some of the Canada Student Loans Program’s clients between 2000 and 2006.

Brabston believes a solid policy on handling and storing protected information should have been in place.

“They’re supposed to be in control,” she said.  “All organizations - the government, anyone - need to have strict guidelines for storing data and everyone needs to be trained to follow those guidelines.”

Although she emphasizes the serious consequences that could come of the privacy breach, Brabston does not think the information was stolen or will be used for identity theft.

Still, Merchant Law Group and Newfoundland-based lawyer Bob Buckingham have stated intentions to bring forward class action lawsuits.

But Brabston is reluctant to believe their cases will stand.

“Unless the lost information was used for fraudulent purposes, I don’t think the case would stand in a court of law,” she said. “They would have to prove that some people in the class were actually damaged by the loss.”

It’s a major breach, but more than that.

University of Winnipeg politics professor Shannon Sampert is also dissatisfied by the handling of the incident.

According to Sampert, the breach is indicative of a lack of responsibility among government officials.

“Ministerial responsibility is no longer there, it’s another example of how this government - governments period, not particularly the Harper government - are disconnected from their need to be responsible for the kind of work that they offer,” said Sampert.

According to Maclean’s magazine, Human Resources Minister Diane Finley has ordered the implementation of new data-loss prevention technology to control or prevent the transfer of sensitive information, along with mandatory training on a new security policy banning portable hard drives.

The HRSDC has offered to provide credit protection at no cost to those whose information was on the missing hard drive. 

Equifax, a credit bureau, has been contracted to provide those affected with protection services for up to six years, flagging their credit files and helping to detect any compromise of their personal information.

HRSDC says it does not believe the information has been accessed.

According to University of Winnipeg staff representative Colin Russell, the university cannot tell how many of its students have been affected.

Russell says there is little the university can do to assist those students. 

“We found out letters were being sent to them by Canada Student Loans,” he said. “So, at the moment, we’re not taking further action on our own.”

Published in Volume 67, Number 18 of The Uniter (January 30, 2013)