Privacy commissioner orders probe into government data leak that may have put Afghans in danger

Privacy Commissioner Daniel Therrien has ordered a formal investigation into a data breach last month at Immigration, Refugees and Citizenship Canada that may have exposed hundreds of vulnerable Afghans to danger, CBC News has learned.

IRCC apologized privately for the leak to several hundred Afghans who had applied for visas. The leak happened after the Trudeau government promised it would accept 40,000 Afghans threatened with Taliban reprisals because of their previous work as rights advocates, journalists or members of the judiciary, or because they belong to religious and ethnic minorities targeted by the fundamentalist group.

But the department did not acknowledge the leak publicly until it was revealed in a CBC News report on October 27.

Therrien ordered the investigation in response to a request by Conservative immigration critic Jasraj Singh Hallan on November 3.

"Action must be taken to address this unacceptable error," Jasraj Singh Hallan wrote to the commissioner. "Faced with the prospect of life or death, the privacy of Afghans seeking refuge cannot be an afterthought. I request that you take immediate action to determine the cause of this data breach, and to assure Canadians and the affected refugees abroad as to what actions will be taken to ensure that this will not occur again."

CBC obtained a copy of the commissioner's reply from a Conservative source.

"We take these allegations seriously and are opening an investigation into this matter based on your complaint," Deputy Privacy Commissioner Brent R. Homan wrote in the reply, dated Nov. 12.

Michael Billinger, senior adviser in the Privacy Act Investigations Directorate, will direct the probe.  

Reply-all error

The data breach took the form of a "reply-all error" in four separate emails. All recipients on a long list of email addresses were able to see the names of all the other recipients — in many cases their faces as well.

The victims were several hundred Afghans who were seeking refuge in Canada because they fear they're at risk of reprisals from the Taliban, who took over the country in August.

The promised visa program for these vulnerable Afghans is still not operating and IRCC is not accepting applicants directly.

The four misdirected e-mails caused panic in Afghanistan because they might have given the Taliban a way to identify another 200 people corresponding with a foreign government and seeking to leave the country as potential enemies of the new regime.

A similar leak from the U.K. government that exposed a smaller number of Afghan visa applicants was followed by a public acknowledgement and an apology in Parliament by the minister responsible, along with an internal investigation and at least one suspension.

'The government should ... take responsibility'

A Toronto man whose sister's name was among those inadvertently leaked by IRCC said he welcomes the investigation. 

"At least it's an action where we can see that the government, or one part of the government, is trying to understand what happened. It's important to understand how it could happen," he said. CBC News is protecting both his identity and that of his sister.

Along with her name, the leak revealed her appearance as well; a photograph of her face can be seen by passing a cursor over her email address. She is currently in hiding in Afghanistan with young children. Her husband, an army officer, was executed by the Taliban earlier this year. She herself worked for Afghanistan's civilian government.

"Investigation is important, but the government should also take responsibility for the consequences on the lives of those people who were affected," her brother in Canada told CBC News. "I make a separation between the issue for the bureaucracy and the government's own systems, and the lives that are at risk."

He said he continues to hear of the Taliban using phone and internet surveillance to track down — and in some cases kill — perceived enemies.

"When I'm talking with her I try to minimize the impact of this situation, not to worry her. But I'm worried," he said.

Although he said he still hopes to get his sister out of the country, he has advised her to drop her application for a new passport to avoid drawing unwelcome attention from the Taliban.