Privacy commissioner orders probe into government data leak that may have put Afghans in danger

Privacy Commissioner Daniel Therrien has ordered a formal investigation into a data breach last month at Immigration, Refugees and Citizenship Canada thatmay haveexposed hundreds of vulnerable Afghans to danger, CBC News has learned.

IRCCapologized privately for the leak to several hundred Afghans who had applied for visas. The leak happened afterthe Trudeau government promised it would accept 40,000 Afghans threatened with Taliban reprisalsbecause of their previous work as rights advocates, journalistsor members of the judiciary, or because they belong to religious and ethnic minorities targeted by the fundamentalist group.

But the department did not acknowledge the leak publicly until it was revealed in a CBC News report on October 27.

Therrienordered the investigation in response to a request by Conservative immigration critic Jasraj Singh Hallan on November 3.

"Action must be taken to address this unacceptable error," Jasraj Singh Hallan wrote to the commissioner. "Faced with the prospect of life or death, the privacy of Afghans seeking refuge cannot be an afterthought. I request that you take immediate action to determine the cause of this data breach, and to assure Canadians and the affected refugees abroad as to what actions will be taken to ensure that this will not occur again."

CBC obtained a copy of the commissioner's reply from a Conservative source.

"We take these allegations seriously and are opening an investigation into this matter based on your complaint,"Deputy PrivacyCommissioner Brent R. Homanwrotein the reply, dated Nov.12.

Michael Billinger, senior adviser in the Privacy Act Investigations Directorate, will direct the probe.

Reply-all error

The data breach took the form of a "reply-all error" in four separate emails. All recipients on a long list of email addresses were able to see the names of all the other recipients in many casestheir faces as well.

The victims were several hundred Afghans who were seeking refuge in Canada because they fear they'reat risk of reprisals from the Taliban, who took over the country in August.

The promised visaprogram for these vulnerable Afghansis still not operating and IRCC is not accepting applicants directly.

The four misdirected e-mails caused panic in Afghanistan because they might have given the Taliban a way to identify another 200 people corresponding with a foreign government and seeking to leave the country as potential enemies of the new regime.

A similar leak from the U.K. government that exposed a smaller number of Afghan visa applicants was followed by a public acknowledgement and an apology in Parliament by the minister responsible, along withan internal investigation and at least one suspension.

'The government should ... take responsibility'

A Toronto man whose sister's name was among those inadvertently leaked by IRCCsaid he welcomes the investigation.

"At least it's an action where we can see that the government, or one part of the government, is trying to understand what happened. It's important to understand how it could happen," he said. CBC News is protecting both hisidentity and that of his sister.

Along with her name, the leak revealed her appearance as well;a photograph of her face can be seen by passing a cursor over her email address. She is currently in hiding in Afghanistan with young children. Her husband, an army officer, was executed by the Taliban earlier this year. She herself worked for Afghanistan's civilian government.

"Investigation is important, but the government should also take responsibility for the consequences on the lives of those people who were affected," her brother in Canada told CBC News. "I make a separation between the issue for the bureaucracy and the government's own systems, and the lives that are at risk."

He said hecontinues to hear oftheTaliban usingphone and internet surveillance to track down and in some cases kill perceived enemies.

"When I'm talking with her I try to minimize the impact of this situation, not to worry her. But I'm worried," he said.

Although he said he still hopes to get his sister out of the country,he has advised her to drop her application for a new passportto avoid drawing unwelcome attention from the Taliban.