2,700 personal tax files go missing after auditor takes work home

The Globe & Mail is reporting that approximately 2,700 personal tax files are missing after a Canada Revenue Agency employee did something that appears staggeringly stupid:

2,700 personal tax files go missing after auditor takes work home - The Globe and Mail

... The major breach occurred in early 2006, when an auditor in the agency’s Toronto office asked a government computer technician to download 37,488 of her e-mails and 776 documents onto 16 CDs. The confidential material covered the years 2000 to 2006, and was not encrypted as required by agency rules.

The woman took the CDs home, and allowed a male friend to copy at least one of them to a laptop.

The breach only came to light when the woman produced the CDs during a grievance hearing before the Public Service Labour Relations Board in 2008. She wanted the panel to read a key 2005 e-mail on one of the CDs, in support of her grievance that the CRA had not accommodated her health problems....

I can't imagine the justification for having taken the unencrypted CDs home. Copying them onto another laptop is simply surreal. But then not reporting the breach of any of the taxpayers involved or to the Privacy Commissioner is staggering.

This is further support to my belief that one of the most significant risks to data security is portable data. If employees are given secure remote access to their work data, the possibility of breaches such as this is virtually eliminated.

Taxman moves to protect privacy

I was interviewed today for Global National's most recent report on privacy problems at the Canada Revenue Agency (our IRS, for my American readers). Since earlier reports on misdirected tax information, many more people have come out to report they have also been the unwitting recipients of information about other taxpayers. See: Taxman moves to protect privacy and also note the many comments in which others relate receiving others' personal information.

I think you can get the video of the feature here: http://video.canada.com/VideoContent.aspx?13750&vc=1&popup=1, but it seems hit and miss to me.

Canada Revenue Agency investigates leaks of info on high profile taxpayers

The Canada Revenue Agency generally takes taxpayer privacy very seriously. It's rare to hear about any leak or misuse of personal information from the federal tax department. Lately, however, the CRA, or at least some of its employees, have come under suspicion as confidential records of high-profile taxpayers have appeared online.

The Candian Press reports on a leak of information about MP and former hockey star Ken Dryden:

Tax office staff warned of disciplinary action as CRA probes Dryden tax leak

GREGORY BONNELL

TORONTO (CP) - Canada Revenue Agency workers are being warned of disciplinary action, including dismissal, following a published report that federal employees had leaked the confidential tax information of Liberal MP Ken Dryden.

"It is unsettling to consider that not all employees may be working with the degree of professionalism and integrity that the CRA expects," writes Larry Hillier, assistant commissioner for the Ontario region, in an internal e-mail to CRA employees obtained by The Canadian Press.

"As with all allegations of wrongdoing, an immediate investigation is being launched to determine if a breach of our standards has occurred," the memo reads. "If warranted, disciplinary action will be taken, up to and including termination of employment."

The tax information of Dryden and several other sports personalities, including former Toronto Maple Leaf Borje Salming, is available on the Internet courtesy of debt collectors who have been illegally leaking the information.

National Revenue Minister Carol Skelton has asked the CRA to launch an immediate investigation in the wake of the original CP report, which was published Saturday.

CRA workers are violating the Income Tax Act, the Privacy Act, and possibly criminal law by feeding information to former employee Alan Baggett, who in turn posts the disclosures to an Internet chat group.

The Dryden story, posted in May 2005, says the former Montreal Canadiens goalie and Leafs general manager once had a "small personal tax debt, which he no doubt paid." A former employee who worked on Dryden's file confirmed the debt to CP.

Neither Dryden nor Salming replied to requests for comment on the postings. The postings did not indicate Dryden's current tax situation.

CRA employees who are found guilty of disclosing tax information, a violation of the Income Tax Act, face fines of up to $5,000 or jail time of up to 12 months - a fact Hillier points out in his memo.

"When one employee breaches confidentiality, as is currently alleged, each and every one of us is impacted," Hillier writes, noting his "high level of confidence in the employees of the Ontario Region."

"You can be assured that all necessary steps are being taken to thoroughly investigate this matter."

Depending on the circumstances, the disclosure of confidential information could also constitute a criminal offence. Under the Criminal Code of Canada, breach of trust by a public officer is punishable by a maximum prison sentence of five years.