The firm overseeing the federal government’s $900 million settlement agreement with service members who were victims of sexual misconduct has admitted to other privacy breaches.
Epiq Class Action Services Canada this week confirmed additional errors after a second veteran contacted The Canadian Press to report receiving an email containing the personal details of another claimant late last year.
France Menard said she decided to speak out after reading an article in The Canadian Press last month that Epiq inadvertently sent former Force colleague Amy Green the names, email addresses and phone numbers. claim of dozens of other plaintiffs and plaintiffs.
Epiq then said it mistakenly disclosed “limited information” from less than 100 of the 20,000 people who sought compensation in the class action settlement to another plaintiff.
“Obviously she’s not the only one,” France Menard said in an interview from her home in Fredericton, New Brunswick. People are now wondering if their information is available. »
The Department of National Defense and attorney Jonathan Ptak, who represents some of the veterans and serving military personnel involved in the three government-settled lawsuits, said Epiq has since confirmed three different privacy breaches.
These include two breaches reported by the company on February 8, when The Canadian Press asked about information sent to Amy Green, and another on February 24, when Epiq was asked about the email sent to France Menard, which she received in November. “We are aware of the two incidents of inadvertent disclosures that affected 91 band members that were reported earlier in February and have just been made aware of an additional inadvertent disclosure involving a band member,” said Jonathan Ptak in an email.
People are now wondering if their information is available
Epiq did not confirm the number of actual or alleged violations to The Canadian Press. But the company, which the Federal Court appointed to administer the November 2019 settlement agreement, said it had launched a “thorough” investigation and taken steps to prevent future issues. “Epiq takes all issues related to data security very seriously,” Angela Hoidas, vice president of marketing and communications, said in a statement.
“While our investigation continues, we are communicating directly with our customers, notifying claimants who we confirm have been affected, and have implemented additional improvements to existing processes. »
The information sent to Mmy Menard and Green consist of the names of individual plaintiffs along with their claim numbers, which can be used to submit documents through a secure link on the class action’s website.
They just wanna pretend it never happened
Angela Hoidas said these documents would then be reviewed by Epiq and the individual files would not be accessible.
France Menard and Amy Green say they are unhappy with Epiq’s response, particularly given the sensitive nature of the claims and the settlement agreement. Both say they are now concerned about their own information being released and believe the company has not been as open as it should be about inadvertent disclosures.
“They just want to pretend it never happened,” said Amy Green, who said she received personal information about 40 other claimants last year. “How many people are affected? It is undeniable that I am not the only one. [L’entreprise] is responsible for at least three offences. »
Both said that, despite requests from the company, they refused to delete the emails they inadvertently received until they were sure of the true scope of the privacy breach. Amy Green said she also sought legal advice.
The Office of the Privacy Commissioner confirmed last week that it had received a privacy breach report and was continuing to work with Epiq and the Department of Defense to obtain more information and determine the next steps.