By Thursday afternoon, 43 of 57 enhanced voters lists from New Brunswick mistakenly handed to politicans and their parties have been returned.
The remaining CDs are expected to be handed over by Friday.
New Brunswick's privacy commissioner says a breach by Elections New Brunswick is potentially the largest ever in the province, given the number of people's information involved.
Elections New Brunswick confirmed on Wednesday it accidentally sent a voters list containing phone numbers, dates of birth and driver’s licence information to Members of the Legislative Assembly and to the Progressive Conservatives and Liberal parties.
Anne Bertrand, the province’s information and privacy commissioner, said there are still many unanswered questions to assess the risk of the breach.
"We don't know how many of the MLAs had picked up their packages, how many had actually viewed them, how many staff are in the various MLA offices who might have had access to this information or copies of the CDs made, etc.," she said.
"All of that makes a big, big, big difference on assessing the actual risk of the data that was on those CDs."
Bertrand said she understands why some personal information such as voters' names, postal codes and genders would be listed in order for MLAs to contact voters in their ridings, but the other collected information doesn't make sense.
"Actually the law provides for that under the elections act, but I just wondered now why the driver's license number and date of birth? I couldn't make a connection," she said.
For Chief Electoral Officer Michael Quinn, the connection is clear.
Quinn said Elections New Brunswick needs personal information to verify voters.
"For example today I checked the list we have 120 people named Roger LeBlanc," he explained, "we have to track that person as they move from town to town, in and out of the province. So you need common indentifiers."
Quinn was pleased to retrieve more of the mistakenly sent CDs.
"As you can well imagine, the breadth of this privacy breach is alarming. We don't know, however, as to the size." But Bertrand said the amount of information out there would make it very easy for identity theft to occur.
"If we stop to think about it, name, address, gender, driver's license number and date of birth – we've got a perfect scenario for identity theft."
Valuable to fraudsters
The potential risk is high, said Bertrand. Such information is very valuable to fraudsters, she said.
"It's such a shame because it doesn't take very much today for identity theft to occur. Every time we add identifiers it becomes very easy for the criminal minds out there who are bent on stealing our identity to create a persona that is not theirs for fraudulent purposes."
Elections New Brunswick is not officially subject to an investigation by the privacy commissioner.
But Bertrand said her office was notified of the breach Wednesday, shortly before the premier informed the legislature, and has been consulted on the matter.
"My office does not have the jurisdiction to investigate other legislative officers," Bertrand said. "However; I'm very pleased to have been notified immediately and I've been asked to lend support and advice and met with Elections New Brunswick – very pleased to report that I will be reviewing this matter."
Only a couple of jurisdictions have changed their laws to allow privacy commissioners to look into the handling of personal information by other legislative officers, such as the chief electoral officer, said Bertrand. New Brunswick is not one of them.
Bertrand said, at this time, she doesn't think it's necessary for her office to have that kind of power.
"I'll tell you why. These instances involving legislative officers handling or mishandling personal information are quite rare across Canada," she said, "We operate under a very high standard of care… to protect the information we’re entrusted with, so I’m not sure whether oversight is the answer."
'Given that my office is there to serve New Brunswickers and we have the resources and we're developing an expertise, I think it's only fitting that they ask for our help and assistance, which we would gladly provide.' —Privacy commissioner Anne Bertrand
She said she expects to provide further assistance to come up with a corrective measures and a comprehensive plan to prevent a similar mistake in the future.
"I think it's very important as privacy commissioner for all New Brunswickers that I be made aware of what's going on, which did take place, and given that my office is there to serve New Brunswickers and we have the resources and we're developing an expertise, I think it's only fitting that they ask for our help and assistance, which we would gladly provide."
Bertrand said she was quite surprised by the breach and isn't sure why Elections New Brunswick even had all of the personal information involved.
"I've been asking myself that question since yesterday," he said.
"I wasn't sure why there's a requirement for data matching to get drivers' licence and date of birth to perform various functions for MLAs to identify voters, you know, for their own purposes."
Each of the 55 MLAs would have received a copy of the voters list for their specific riding. The party offices received a list with electors in all 55 ridings.
There are 553,000 people on the voters list. Michael Quinn, the province's chief electoral officer, estimated on Wednesday that 90 per cent of the names on the list included a driver's licence number and a "very high percentage" would have also included a date of birth.
However, a smaller number would have also included a phone number.
The Progressive Conservatives and Liberals have agreed to return all copies of their voters lists as soon as possible and to destroy and copies that may have been made.
Ron Armitage, the manager of voter information systems at Elections New Brunswick, apologized for the error on Wednesday.