Privacy commissioner orders probe into government data leak that may have put Afghans in danger

Privacy Commissioner Daniel Therrien has ordered a formal investigation into a data breach last month at Immigration, Refugees and Citizenship Canada that may have exposed hundreds of vulnerable Afghans to danger, CBC News has learned.

IRCC apologized privately for the leak to several hundred Afghans who had applied for visas. The leak happened after the Trudeau government promised it would accept 40,000 Afghans threatened with Taliban reprisals because of their previous work as rights advocates, journalists or members of the judiciary, or because they belong to religious and ethnic minorities targeted by the fundamentalist group.

But the department did not acknowledge the leak publicly until it was revealed in a CBC News report on October 27.

Therrien ordered the investigation in response to a request by Conservative immigration critic Jasraj Singh Hallan on November 3.

"Action must be taken to address this unacceptable error," Jasraj Singh Hallan wrote to the commissioner. "Faced with the prospect of life or death, the privacy of Afghans seeking refuge cannot be an afterthought. I request that you take immediate action to determine the cause of this data breach, and to assure Canadians and the affected refugees abroad as to what actions will be taken to ensure that this will not occur again."

CBC obtained a copy of the commissioner's reply from a Conservative source.

"We take these allegations seriously and are opening an investigation into this matter based on your complaint," Deputy Privacy Commissioner Brent R. Homan wrote in the reply, dated Nov. 12.

Michael Billinger, senior adviser in the Privacy Act Investigations Directorate, will direct the probe.  

The data breach took the form of a "reply-all error" in four separate emails. All recipients on a long list of email addresses were able to see the names of all the other recipients — in many cases their faces as well.

The victims were several hundred Afghans who were seeking refuge in Canada because they fear they're at risk of reprisals from the Taliban, who took over the country in August.

The promised visa program for these vulnerable Afghans is still not operating and IRCC is not accepting applicants directly.

The four misdirected e-mails caused panic in Afghanistan because they might have given the Taliban a way to identify another 200 people corresponding with a foreign government and seeking to leave the country as potential enemies of the new regime.

A similar leak from the U.K. government that exposed a smaller number of Afghan visa applicants was followed by a public acknowledgement and an apology in Parliament by the minister responsible, along with an internal investigation and at least one suspension.

A Toronto man whose sister's name was among those inadvertently leaked by IRCC said he welcomes the investigation.