Greg Essensa said at a Tuesday morning news conference that Elections Ontario can't account for two unencrypted memory sticks containing information about people who voted in last fall's provincial election. Two Elections Ontario staff members did not follow standard protocol when it came to handling that information, Essensa said.
Typically, such information on memory sticks has to be password protected and encrypted.
"I take this matter extremely seriously and I want to sincerely apologize to all Ontarians for any concern that this notification may cause," Essensa said.
Elections Ontario doesn't believe voter information has been accessed, Essensa said.
Warning applies to 49 ridings
The breach occurred as Elections Ontario was working on voter information for 49 of Ontario's 107 ridings. Work on 20 to 25 of the ridings was completed, but staff can't identify exactly which ridings were affected.
So Elections Ontario is telling Ontarians in those 49 ridings that their personal information has been compromised. The warning applies to four million eligible voters.
It's an "unprecedented" breach of privacy in the province and possibly in Canada, said Ontario's Privacy and Information Commissioner Ann Cavoukian.
"That's a huge number. That's larger than the size of most provinces," she said. "It is quite massive in its scale."
The information on the missing memory sticks includes the full name, address, gender and birth date of voters and may also include information on whether or not these same individuals voted. The sticks didn't contain social insurance numbers, health card or driver's licence information, telephone numbers, banking information or email addresses, he said.
The privacy breach is now under investigation by the Ontario Provincial Police and Ontario’s information and privacy commissioner.
Accidents can happen, which is why it's important to take precautions such as severing the personal information from the data or encrypting the data, Cavoukian said.
"All of this information on upwards of two million Ontarians is now in the hands of God knows who," said Cavoukian, who's investigating the incident.
"And that's what upsets me because it wasn't encrypted, even though their policy was to encrypt the data."
Essensa said he found out about the privacy breach on April 27. He informed Ontario's three party leaders about the matter on Monday.
Essensa insists the breach did not in any way affect the outcome of last fall's election.
Similar breach in N.B.
Last month, New Brunswick's electoral office revealed that a computer containing the personal information of every eligible voter in that province had been stolen.
Two laptops were taken from the Elections New Brunswick office, one of which contained drivers' licence numbers, birth dates and phone numbers of the 553,000 eligible voters.
Ontario Premier Dalton McGuinty said he hopes Elections Ontario will provide some assurances that such privacy breaches won't happen again.
"Obviously it's unfortunate," he said in Guelph. "We've got to take these privacy matters very seriously."