Court Expands Class Action Lawsuit on Student Loan Data Breach

9 June 2015

In early 2013, the Canadian federal government revealed that a hard drive that stored personal information from more than 500,000 student loan recipients had disappeared. Kept in a Human Resources and Skills Development Canada (HRSDC) office in Gatineau, Quebec, the hard drive was lost without a trace, exposing the affected loan recipients to potential identity theft and fraud.

Now, the Federal Court of Appeal has ordered the class action lawsuit brought by the students to be expanded. Previously, this expansion was denied because there was no proof that any of the missing information was used for fraud. The appeals court overturned that decision on the basis that when a lawsuit involves breach of contract and negligence, specific damages don’t need to be demonstrated before the case can go to court. This means that in future cases where information was lost or revealed negligently, the victims may not need to prove that it has actually been acquired by criminals before they’re able to sue.

Two and a half years after it went missing, the hard drive has still not been located. It contained detailed personal data on 583,000 people who participated in the Canada Student Loans program between 2000 and 2006, including names, social insurance numbers, contact information, dates of birth and the balances on their student loans. It also stored contact information for 250 HRSDC employees.

A report on the incident released a year after the loss of the hard drive showed that the information was lost due to a government employees’ failure to comply with government policies. The device was left unsecured, unencrypted and had no password protection in place at the time that it disappeared. Moreover, employees were not alerted to the fact that the device contained sensitive information. The government has promised that it will take steps to ensure nothing similar happens again.

“The department has taken action to prevent future incidents including: reviewing the ways that employees handle Canadians’ data and fix any gaps that allowed this to happen, updating network security practices to prohibit external hard drives, and providing more mandatory training for all employees on the proper handling of sensitive and personal information,” said Employment and Social Development Canada spokesman Eric Morrissette.

The class action lawsuit accuses the government agency of negligence, breach of confidence, breach of contract and warranty and the tort of intrusion upon seclusion. The decision that damages need not be proven in order to move forward with this type of case could have “far-reaching implications for other similar cases,” according to the Toronto Star.

“The whole area of privacy class actions and digital litigation over privacy breaches is in its infancy in Canada,” said lawyer Ted Charney, who is representing the plaintiffs in the case. “This is a pioneering decision in terms of what you need to establish at certification.”

You can work diligently to reduce the chances of your data being revealed in a security breach, but protecting all of your information is impossible. If you find that your information has been compromised a credit monitoring service can alert you to certain types of activity that might indicate fraud in your credit files.