Overview

• The unencrypted USB key lost in March 2022 contained sensitive data on 1,741 individuals, including victims, witnesses, informants, officers and civilian staff.
• The RCMP violated the Privacy Act by failing to report the device’s loss promptly and disclosing personal information without consent.
• The watchdog learned from a confidential source that criminals offered the stolen data for sale three weeks after it went missing.
• The Privacy Commissioner recommended approved-device lists, regular audits and mandatory staff training to secure USB storage use.
• The RCMP has agreed in principle to adopt the measures and launched a policy review and awareness program across Canada.