Email mistake leads to privacy investigation into Sask. hunting licence system

An investigation has been opened into thousands of emails sent to the wrong people through the province’s Hunting, Angling and Trapping Licence (HAL) system.

Last last week, the third-party company that manages the HAL system sent out about 33,000 emails reminding people to fill out hunter harvest surveys. However, the emails with full names and HAL numbers were sent to the wrong addresses.

Saskatchewan’s Ministry of Environment said in a statement it wasn’t a hack or a breach, it was human error — a mistake made by someone at the managing company, Aspira. The statement explained that when the emails were set up in Aspira’s system there was a mismatch between the information in the body of the email and the email address.

Because a password is still needed to access a HAL account, the ministry doesn’t believe any personal information was breached, but it’s still offering a new HAL number to anyone who wants one.

The ministry said the breach was reported to the Office of the Information and Privacy Commissioner on Friday, but the incident wasn’t revealed to the public. The NDP was the first group to make the situation publicly known.

“The fact they are saying nothing leaves a lot of people concerned about, ‘Is this something to be concerned about? Is it not? What are they doing about it?’ ” said NDP Environment critic Erika Ritchie.

Ritchie said when these kinds of things happen, people are looking for assurance, and the fact the government hadn’t communicated with the people involved or the wider public is a concern.

The government said it notified people within 24 hours that they had been sent the incorrect information and a correction was sent out. But the correction didn’t indicate whether that person’s information had been sent to someone else, only that the information sent to that person had been wrong.

The ministry said it is communicating directly with affected account-holders.

The province’s privacy commissioner wasn’t able to say much about the investigation on Monday, stating he’d been contacted by both the minister and the NDP and his office was just starting its investigation.

The provincial government contends no private information was breached, but commissioner Ron Kruzeniski said that will be part of the analysis.

“One of the first questions we ask is, ‘Is there a breach or not?’ And if the ministry presents arguments saying there was no breach here, then certainly we have to look at that and take a look at it seriously,” said Kruzeniski.

With more and more systems and programs and information being hosted and used online, Kruzeniski said he’s seeing more and more privacy breaches.

“We live in a totally different world now. We’ve gone digital and so much information is saved digitally: Emails go out, people access websites, and then there are people throughout the world who have an interest in that information. And we have people working on these systems and things happen,” said Kruzeniski.

The commissioner was quick to point out that bad actors aren’t necessarily the cause of any possible breach in this case.

The report from the privacy commissioner’s office is expected to be finished in several months.

Editor’s Note: This story has been updated with new details provided by the Ministry of Environment.