Privacy Commissioner Philippe Dufresne is opening an investigation into a massive Crime Stoppers data breach, his office said in a Tuesday statement.
The probe is focused on Navigate360, the U.S. third party that Crime Stoppers chapters worldwide had hired to manage and secure its anonymous tips.
A CBC News investigation last week had revealed that more than 1.5 million Canadian tips submitted to Crime Stoppers programs across the country over the past 25 years were compromised when Navigate360 was hacked last March.
The commissioner will look into “the security safeguards that Navigate360 had in place at the time of the breach” to determine whether it complied with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
On Friday, Navigate360 confirmed its systems had been breached. It was its first public acknowledgment of the hack, seven months after it happened.
CBC has reached out to the company and the Canadian Crime Stoppers Association (CCSA) for comment on the privacy commissioner’s investigation.
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
Crime Stoppers had ‘potentially one of the most harmful data breaches’ Canada has seen. What’s next?
The Office of the Privacy Commissioner said its focus is on “ensuring that the necessary steps are being taken to address the breach and protect Canadians’ personal information. This includes breach containment and measures to reduce risks to those affected, as well as actions to prevent future breaches.”
It said it is in touch with the CCSA and has offered “expertise and guidance with regard to responding to a privacy breach.”
Canadian privacy watchdogs powerless to hold Crime Stoppers accountable for data breach
Police services across Ontario suspend use of Crime Stoppers after CBC investigation
The statement also clarified that PIPEDA does not apply to not-for-profit organizations like the CCSA and its local chapters, a legal gap that CBC News reported on last week.
CBC’s original investigation revealed that more than 850,000 tips — about half of all Canadian records identified — had included personally identifiable information.
The personal information captured in some compromised tips was detailed enough for CBC to contact more than a dozen tipsters who reacted with shock and fear for their safety.
