Privacy commissioner probes Crime Stoppers data breach

Canada’s privacy commissioner is opening an investigation into the Crime Stoppers data breach, his office said in a statement Tuesday, CBC News reported.

Commissioner Philippe Dufresne’s probe focuses on Navigate360, the U.S. company Crime Stoppers chapters worldwide hired to manage and secure anonymous tips. The office said it will examine “the security safeguards that Navigate360 had in place at the time of the breach” to determine whether the company complied with the Personal Information Protection and Electronic Documents Act, or PIPEDA. The office’s notice is titled “Privacy Commissioner of Canada to investigate data breach involving Crime Stoppers.”

The office said its focus is on “ensuring that the necessary steps are being taken to address the breach and protect Canadians’ personal information,” including containing the breach, reducing risks to those affected and preventing future breaches. It said it is in touch with the Canadian Crime Stoppers Association and has offered guidance on responding to a privacy breach.

CBC’s original investigation found that more than 1.5 million Canadian Crime Stoppers tips leaked, and that more than 850,000 of them, about half of the Canadian records identified, contained personally identifiable information. CBC said the detail in some tips was enough for its reporters to contact more than a dozen tipsters, who reacted with shock and fear for their safety. The report said the statement was the first public acknowledgment of the hack, seven months after it happened. CBC said it had asked the company and the association for comment on the commissioner’s investigation.

University of Ottawa law professor Michael Geist told CBC the move is welcome but raised a question about its reach. “The big question is whether it will be positioned to address potential violations,” he said in an email. He noted that federal privacy law is limited to commercial activity, which he called a “long-standing concern.”

The investigation follows a week of fallout. Winnipeg police suspended Crime Stoppers after the breach, and our earlier report found that pauses had spread to 35 agencies. The breach also comes days after Loblaw’s chief executive apologized to two million customers over a separate data breach.

The investigation has just begun, and the commissioner has not set out a timeline or any findings.

If you find reporting like this useful, consider supporting Canada News Media, an independent Canadian newsroom with no corporate parent.