Lost RCMP USB stick identifying informants and witnesses offered for sale by criminals

National Post

10-06-2025

The RCMP lost a memory key containing personal information about victims, witnesses and informants, and later learned it was being offered for sale by criminals, the federal privacy watchdog says.
Article content
A detailed report from the office of privacy commissioner Philippe Dufresne reveals the RCMP told the watchdog about the breach in March 2022, prompting a lengthy investigation.
Article content
Article content
The RCMP determined that the unencrypted USB storage device contained the personal information of 1,741 people, including witnesses, complainants, subjects of interest, informants, police officers and civilian employees.
Article content
Article content
'The RCMP's investigation also established that only some of the documents on the device were password protected and that the device itself was not encrypted nor password protected,' the privacy watchdog's report says.
Article content
The Mounties learned from a confidential source three weeks after the loss that the data on the device was being offered for sale by members of the criminal community.
Article content
'Given the nature and sensitivity of the information that the RCMP handles on a daily basis, (our office) would have expected the RCMP to have strict security measures in place to safeguard its information holdings,' the privacy commissioner's report says.
Article content
Article content
'We also would have expected for those measures to be stringently monitored and that the RCMP would take prompt action where non-compliance, whether accidental or not, is discovered.'
Article content
Article content
Dufresne's office found the RCMP violated the Privacy Act, given that the personal information of individuals was disclosed without their consent.
Article content
The privacy watchdog also concluded that RCMP personnel failed to report the loss of the USB storage device to the force's authorities in a timely manner.
Article content
However, once aware of the breach, the RCMP's notification to affected individuals and the steps taken to manage the risk of further harm to them were 'generally appropriate in the circumstance,' the report says.