RCMP thumb drive with informant, witness data obtained by criminals: watchdog

Jim Bronskill · The Canadian Press

· Posted: Jun 09, 2025 7:05 PM EDT | Last Updated: 1 hr ago

The RCMP mislaid a USB cardinal containing idiosyncratic accusation astir victims, witnesses and informants, and aboriginal learned it was being offered for merchantability by criminals, the national privateness watchdog says.

A elaborate study from the Office of the Privacy Commissioner of Canada reveals the RCMP told the watchdog astir the breach successful March 2022, prompting a lengthy investigation.

The RCMP determined that the unencrypted retention instrumentality contained the idiosyncratic accusation of 1,741 people, besides including subjects of interest, informants, constabulary officers and civilian employees.

"The RCMP's probe besides established that lone immoderate of the documents connected the instrumentality were password protected and that the instrumentality itself was not encrypted nor password protected," the privateness watchdog's study says.

The Mounties learned from a confidential root 3 weeks aft the nonaccomplishment that the information connected the instrumentality was being offered for merchantability by members of the transgression community.

"Given the quality and sensitivity of the accusation that the RCMP handles connected a regular basis, [our office] would person expected the RCMP to person strict information measures successful spot to safeguard its accusation holdings," the privateness commissioner's study says.

"We besides would person expected for those measures to beryllium stringently monitored and that the RCMP would instrumentality punctual enactment wherever non-compliance, whether accidental oregon not, is discovered."

Privacy Officer Philippe Dufresne's office recovered the RCMP violated the Privacy Act, fixed that the idiosyncratic accusation of individuals was disclosed without their consent.

The privateness watchdog besides concluded that RCMP unit failed to study the nonaccomplishment of the USB retention instrumentality to the force's authorities successful a timely manner.

However, erstwhile alert of the breach, the RCMP's notification to affected individuals and the steps taken to negociate the hazard of further harm to them were "generally due successful the circumstance," the study says.

Finally, Dufresne's bureau recovered the RCMP failed to instrumentality due measures to safeguard the idiosyncratic information.

The privateness watchdog recommended the RCMP follow strict information measures for the usage of USB retention devices.

This included measures not lone to guarantee that lone approved USB devices are used, but besides audits to corroborate that devices are returned erstwhile nary longer needed, arsenic good arsenic further training, the study says.

The commissioner reports that the Mounties agreed successful rule to the recommendations but did not perpetrate to implementing them wrong a circumstantial timeline.

RCMP spokesperson Robin Percival said Monday the unit initiated a reappraisal of its information and privateness policies, arsenic good arsenic its consciousness program, to guarantee employees were reminded and sensitized of their continual responsibilities to support delicate information.

"The programme besides addresses the contiguous actions to beryllium taken successful lawsuit of a information breach," Percival said successful a written response.

The RCMP remains committed to preventing the usage of unauthorized and unencrypted USB retention devices and to implementing due measures and solutions crossed the country, she added.