B.C. launches review of ministries’ management of personal information after search for back-up drive comes up empty

A misplaced unencrypted back-up hard drive containing student information over a 23-year period has spurred a cross-government review of how British Columbia’s government ministries manage personal information.

In total, the missing hard drive contains about 3.4 million education records tied to individuals between 1986 and 2009, and includes their names, postal codes, grades and personal education numbers, notes a statement Tuesday from B.C.’s Ministry of Technology, Innovation and Citizens’ Services. The hard drives were back-ups, meaning all files related to student records are still with the government under standard data security processes, the ministry reports.

The review by the Office of the Chief Information Officer seeks to ensure the provincial government is doing everything possible to protect personal information and prevent privacy breaches, Amrik Virk, the province’s technology, innovation and citizens services minister, says in the statement. “I have directed the province’s chief information officer to undertake a review to make sure that our privacy protection policies and procedures are as robust as they possibly can be,” Virk emphasizes.

There is no indication the data in question – most of which appears to pose low risk, but some of which is sensitive – has been accessed or used, the ministry statement notes.

“The risk to individuals is thought to be low because the data on the missing hard drive does not contain financial or banking information, social insurance numbers or driver’s licence numbers. As well, the data is at least six years old and up to 30 years old,” the ministry reports.

That said, the drive also contains a smaller number of records in files that include more sensitive personal information. “So while the amount of these files is smaller, the information is much more personal,” Virk said during a press conference.

The ministry statement notes the more sensitive information includes the following:

• 825 survey results from 2003 of teachers aged 53 or older on their retirement plans;
• 1,052 personal education numbers, birth years and grad dates for cancer survivors from a study on their education outcomes; and
• 9,273 personal education numbers connected to children in the care of the Ministry of Children and Family Development before 2006-2007, including information such as health and behaviour issues and supervision status.

The ministry notes this sensitive information could be connected to names by comparing the personal education numbers to names through the larger data file. “If you put quite a bit of work into it, you could cross-reference these pieces,” Virk told reporters.

The incident touching off the provincial review followed a review by B.C.’s Ministry of Education to ensure it was in compliance with data-storage standards.

The ministry was undertaking a complete records review – which involved extensive physical and electronic searches – when it “was unable to locate a Western Digital external hard drive that was one of two back-ups the ministry created in 2011,” the ministry reports.

The back-up drive was created as part of the business continuity planning at the time to ensure that the ministry had access to these records in the event of a natural disaster, Virk (pictured below) pointed out. Storing information of that nature “is certainly a potential problem, and is not in compliance with our data storage standards,” he told reporters.

While trying to locate the back-up drive, it was discovered that duplicate disks existed in a large warehouse, Virk said. “We were out there in that warehouse literally searching box by box, grid pattern,” the minister reported.

“We had up to 50 people involved in this, searching every nook and cranny, opening every box and sifting through the contents. And we did that on multiple occasions just to be absolutely certain,” he continued, but the drive could not be located where records indicated it had been stored.

Beyond the chief information officer review, Virk says that the Service BC info line is able to help British Columbians and others find out if their information is likely on the drive, and what sort of information it would be.

In addition, Virk told reporters that staff are now taking comprehensive training in data security. “The standards that we train our people to is beyond what’s required by the Office of the Chief Information Officer, and that training is mandatory and it’s ongoing,” he added.

“British Columbians expect us to ensure their information is safe – and this is an incident that should have never happened,” Virk says in the statement. “The Ministry of Education will be the first ministry to be examined as part of this cross-government review. British Columbians deserve the highest standards of information management,” the minister adds.

Efforts will continue to locate the missing drive, including the possibilities that it has been stored in another location or it has been destroyed.

The ministry has also provided an FAQ for those concerned about potential identify theft.