Ontario privacy breach shows policies useless if not followed: commissioner

HALIFAX – Ontario’s privacy commissioner says organizations need to beef up enforcement of their privacy policies after a major breach of information involving more than two million voters in the province earlier this year.

In a paper released today, Ann Cavoukian says privacy policies are ineffective if they are not understood and followed.

She will address her findings today during a Canadian Bar Association meeting in Halifax.

In April, Elections Ontario discovered a major privacy breach when two memory sticks were lost containing the personal information of some 2.4 million voters, such as names, addresses and birthdates.

Cavoukian previously found that the staff who lost the USB sticks didn’t encrypt the files because they didn’t know what encryption meant.

Her new paper makes seven recommendations, including developing privacy education and awareness training programs, as well as conducting privacy audits of the organization and ensuring mobile devices are encrypted and password-protected.