At Saskatchewan’s Ministry of Immigration and Career Training, a former employee is being accused of accessing client information as part of what was described as an immigration “scheme.”
According to a report from the Saskatchewan Information and Privacy Commissioner, an investigation into the unnamed employee started in January last year. Deputy Minister of Immigration and Career Training Richelle Bourgoin said the investigation was also around the employee inappropriately accessing information, but couldn’t say whether it was related to the scheme outlined later.
Over the next several months, two complaints came in from clients, reports were ordered and third-party investigations undertaken.
They came to find that the privacy of 40 clients had been breached as of the end of May; Bourgoin said the ministry doesn’t expect that number to grow.
For some clients, it was just their contact information, but for others it was information on their passports, employment, finances and family members.
The allegations around the employee are that they were accessing clients’ personal information and sharing it with someone outside government as part of an “illegal immigration scheme,” according to the commissioner’s report. The third party would then contact the client and ask for money in exchange for their application to be approved.
All of the incidents were regarding Saskatchewan Immigrant Nominee Program (SINP) applications.
The investigation
The first complaint came in April 2022 and a report from the ministry’s internal system near the end of that month showed unusual activity from the employee. But the employee’s access to the system wasn’t revoked until mid-July.
The commissioner’s report showed that in the intervening months the employee continued to access the system, inappropriately going into people’s files.
In explanation, Bourgoin said ministry officials wanted to go through the investigation process and make sure they got it right.
“I think what we were looking at is the complexity of the process, wanting to ensure that we conducted the investigation in a way that protected both the client of the program and the integrity of the program, while at the same time being thorough and ensuring that we were fulfilling our duty of responsibility,” she said.
The employee had been investigated in 2020 about inappropriate access to systems but the ministry said the allegations at that time weren’t substantiated.
The ministry told the commissioner the reasons the employee gave for the breaches didn’t make sense, and the only root cause it could find is that the employee didn’t think they would get caught.
“We have our suspicions that the employee or a known associate may have had criminal intent, but as that investigation is ongoing at this time, we cannot state that with sense of certainty,” the ministry told the commissioner, according to his report.
Many of the breaches happened after hours or when the employee was on vacation. In his report, the commissioner pointed out that some pandemic protocols remain in place in the ministry, like employees taking their computers home with them in the evenings and on weekends in case they get sick and can’t come back into the office.
Bourgoin was asked why there weren’t any system safeguards in place to stop an employee from inappropriately accessing files.
“I think we were confident in the systems that we have in place to protect not only the integrity of the program, but the privacy of the individuals who make application to the Saskatchewan Immigrant Nominee Program,” she replied.
The employee quit last August, just about two weeks before an independent investigator released their report that found there was inappropriate access.
The reaction
Bourgoin said the ministry has enhanced its training to make sure this sort of thing doesn’t happen again. It’s also really looked at building and strengthening its internal audit system.
The ministry told the commissioner it has changed its system to allow it to do internal proactive audits of its systems. Previously, they had to be done by a third party and were very expensive.
Bourgoin didn’t seem worried the incident would taint the SINP program; she said maintaining the integrity of the program is the ministry’s top priority.
“We’re confident that the steps that we have taken to mitigate this isolated case from occurring again will ensure that the community has got confidence in the program and that we continue to use the SINP to really advance the economic outcomes in this province that we are looking to achieve,” explained Bourgoin.
She also said the ministry is confident in the integrity of its files and isn’t concerned that any applications were approved because of any payments.
To reassure people about the program, Bourgoin said the ministry is looking at how it can enhance its training framework and strengthen its audits, using the resources it has available.
“(The goal is) to provide reassurances, not only to the employers of the economically driven immigration program but to the applicants, that the SINP is beyond reproach when it comes to the delivery of our programs and services,” said Bourgoin.
The ministry has passed the file on to the Canada Border Service Agency for investigation, and is working with the Ministry of Justice on the possibility of charges under the Freedom of Information and Protection of Privacy Act (FOIP).
The clients’ privacy
The commissioner concentrated on the privacy breach in his report, pointing out the affected people weren’t told about the breach until February this year – about nine months after the breach happened and five months after the report determining there had been inappropriate access.
The commissioner found the ministry didn’t take appropriate or timely action to contain the breach, that its notice to the affected parties wasn’t adequate, and that its investigation wasn’t adequate. The commissioner did find the ministry has identified steps to ensure this doesn’t happen again.
Bourgoin said Immigration is working with the Ministry of Justice to prepare its response to the commissioner’s report and figure out how the recommendations could be implemented.