Ontario IPC: Toronto SAMS Data Breach Prompts City Privacy Orders

• A City of Toronto employee made 160 unauthorized accesses to 14 client profiles on the Social Assistance Management System (SAMS) between April 2023 and September 2024.
• The accessed data included sensitive personal information, and the employee had no work-related reason for viewing these files, which belonged to clients of Region of Peel Social Services.
• The Information and Privacy Commissioner of Ontario (IPC) identified gaps in the city's privacy safeguards, including a lack of annual training, confidentiality agreements, and audit protocols.
• The IPC concluded the incident posed a real risk of significant harm due to the sensitive data, intentional accesses, and likely further disclosure, recommending notification to all affected individuals.
• The case emphasizes the need for robust privacy measures ahead of mandatory MFIPPA breach notification requirements taking effect on January 1, 2027.

The IPC concluded the incident posed a real risk of significant harm due to the sensitive data, intentional accesses, and likely further disclosure.

The Information and Privacy Commissioner of Ontario (IPC) has addressed a significant data breach involving the Social Assistance Management System (SAMS) in Toronto, where a City of Toronto employee improperly accessed the personal information of 14 individuals. The incident, which came to the IPC's attention through a report in August 2024, revealed that a Toronto Employment and Social Services staff member engaged in 160 unauthorized accesses to client profiles between April 4, 2023, and September 22, 2024. Each of the 14 affected profiles was accessed between one and 36 times, indicating a pattern of repeated unauthorized activity.

The city's investigation determined that the employee had no legitimate work-related reason to view these specific client files. The individuals whose data was accessed received services from Region of Peel Social Services, not Toronto, further underscoring the lack of professional justification. The employee's connections to the individuals were personal, identified through shared surnames, maiden names, addresses, or relationships to the employee's former spouse or children. The initial report to the IPC also alleged that the employee disclosed this information to others, potentially with the intent to shame the clients.

Sensitive personal details were potentially exposed during these accesses. The information viewable through the SAMS pages included names, birth dates, address histories, rental obligations, income and asset information, status in Canada, caseworker notes, social assistance applications, and copies of government-issued identification. While the City of Toronto could not definitively confirm whether the information had been improperly shared, printed, or otherwise disclosed beyond the initial access, the nature of the accesses raised serious privacy concerns.

Following its review, the IPC identified several critical gaps in the City of Toronto's existing privacy safeguards. Specifically, the city was found not to be conducting annual privacy training, nor did it require annual confidentiality agreements for its Social Services employees. Furthermore, there was an absence of auditing protocols for employee use of the Social Assistance Management System (SAMS), which contributed to the undetected nature of the prolonged unauthorized accesses.

In response to these deficiencies and the Ontario IPC Toronto SAMS data breach, the Commissioner issued a letter to the City of Toronto outlining a series of recommendations. These included implementing stronger, annual privacy training for all staff with access to personal information, requiring annual confidentiality agreements, establishing a documented privacy breach response plan, and developing a formal policy or audit protocol specifically for electronic files. These City of Toronto privacy recommendations aim to bolster the municipality's data protection framework and prevent similar incidents in the future.

The IPC conducted an assessment of the breach using its real risk of significant harm (RROSH) framework, concluding that the incident indeed posed a real risk of significant harm to the affected individuals. This determination was based on several factors: the highly sensitive nature of the information involved, the intentional character of the accesses, and the likelihood of further unauthorized disclosure. The IPC noted that the incident came to its attention through a member of the public who reported awareness of the employee's accesses and disclosures, strongly suggesting that information had indeed been shared beyond the initial breach.

Given the finding of a real risk of significant harm, the IPC recommended that the City of Toronto notify all individuals whose information was accessed without authorization. The IPC has since closed its file on the matter, but this closure is conditional upon the City of Toronto giving due consideration to its recommendations. The Commissioner explicitly stated that the file could be reopened if additional information emerges that warrants further inquiry, underscoring the ongoing responsibility of the city to address these issues.

This case highlights the evolving regulatory environment for public sector privacy in Ontario. New privacy safeguards and mandatory breach notification requirements under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) are set to take effect on January 1, 2027. The IPC's conditional closure of the Toronto SAMS data breach file emphasizes the importance of municipalities preparing for this upcoming MFIPPA breach notification 2027 regime.

The IPC's detailed recommendations, including robust privacy training, confidentiality agreements, and audit protocols, serve as a clear indicator of the Ontario privacy commissioner's expectations for public bodies. This incident underscores the critical need for comprehensive Social Assistance Management System privacy protocols and proactive measures to safeguard sensitive client data, aligning with the IPC's commitment to ensuring public sector accountability and data protection.

This case highlights the Information and Privacy Commissioner of Ontario's (IPC) expectations for robust privacy safeguards, training, and breach response protocols, particularly for public sector entities. Lawyers and compliance officers should advise clients, especially municipalities, to proactively review and update their privacy frameworks to align with IPC recommendations and prepare for the mandatory MFIPPA breach notification requirements taking effect January 1, 2027.

Source: Original reporting via The Canadian Press