The government of Manitoba has revealed that there has been a privacy breach at its Children's Disability Services (CDS) program, involving an email containing information on thousands of clients being accidentally sent to the wrong recipients.
“On Aug. 26, CDS staff accidentally sent an email intended for the Manitoba Advocate for Children and Youth (MACY) to about 100 agencies and advocacy groups," a news release from the government said.
According to the Manitoba Families department, the email was mistakenly sent to service agencies and community advocates that work with individuals with disabilities.
The release also explained that the email contained a spreadsheet with information on approximately 9,000 children who are CDS clients. The email also has information about “a matter currently being reviewed by MACY.”
The CDS data potentially leaked by the misplaced email included personal information about the children, their diagnoses, and addresses. The information did not include personal health identification numbers, social security numbers, or any financial information, the government said.
Although the spreadsheet was password protected, the password was also provided in the mistakenly sent email, CBC News reported.
The government has called for all the recipients to ensure that the email was deleted.
"Manitoba Families has agreements in place with service providers that set out expectations for protecting personal information, in addition to their broader legal requirement to protect privacy and confidentiality,” the statement continued.
“The mistake was human error, however the department is following up with staff to review and improve processes to avoid this happening again.”
On top of advising all affected families of the breach, the province has referred the issue to the Manitoba ombudsman.
Global Privacy and Security by Design Centre executive director Ann Cavoukian expressed her disappointment in how the government handled the situation.
"I know data breaches happen and mistakes happen. If you're sending it to one group and you get it wrong and it ends up in the hands of another group, things happen. But 100 different groups? How does that happen? That's huge,” Cavoukian told CBC News.
Although Cavoukian – the former privacy commissioner of Ontario – does not suspect any of the agencies or community advocates that received the email to do something with the information, she says it is still a fact that the information is now out there.
"As you distribute personal information like this to organizations that aren't supposed to have it, invariably something happens," she warned.
