Edmonton Public School District did not follow its own policy in the loss of memory stick containing personal information of more than 7,500 employees, says the Alberta privacy commissioner.

An investigation by the Office of the Information and Privacy Commissioner found information on the USB memory stick was not protected by a password or encryption.

The data included employment applications, resumes, transcripts, completed direct deposit forms (including cheques), copies of identity verification (i.e. driver’s licenses, first page of passports, birth certificates, etc.), injury forms, payroll correspondence, pension correspondence, benefits forms and correspondence, education credentials (i.e. certificate, degree, diploma etc.), job information history, pay-benefits history, performance evaluations, police criminal records check reports, etc., the report said.

While the stick contained personal information of 7,662 employees, for 4,836 of these individuals there was minimal personal information (i.e. demographic information, employee ID number), the report said.

However, for 2,826 individuals, the images on the USB stick "included considerable personal information, including social insurance numbers, banking information or both."

The stick, which remains missing, was lost Mar. 23, 2011 after an IT staff member pocketed it while at work but could not find it two hours later.

Employees filed complaints

On Mar. 29, the district notified the commissioner and began contacting employees.

A number of the people whose information was on the stick complained to the commissioner.

The investigation found that even though the district had policies, guidelines, training and practices in place, they were not followed in this incident.

It also found that the district had retained the personal information on a computer hard drive for a longer period of time than was necessary.

The School District says that, as of May 24, 2011, the breach had cost it $46,000 in staff time, overtime, supplies, postage, and other miscellaneous expenses.

Since the investigation the district has taken steps to prevent a similar incident, said the commissioner.