A major Canadian government website malfunctioned and publicly displayed the personal information of about 75 people, CBC News has learned.

A Canadian government website malfunctioned recently and publicly displayed the personal information of about 75 people. (CBC)

This glitch affected some Service Canada account holders as their accounts were transitioned from the old e-pass site to the new Access Key site, which aims to be a "one-stop shop" for Canadians to manage benefits such as employment insurance, pension plans and old age security.

The glitch allowed some users to see the information of other users, including social insurance numbers and banking information.

On Sept. 28, users notified Service Canada that something was wrong, and the site was shut down for repair. It then took managers at Service Canada three days to notify the Office of the Privacy Commissioner.

"While it's reasonable for organizations to first determine whether or not there is a problem, we do have some concerns about the delay in being contacted about this breach," said the Privacy Commissioner spokesperson Anne-Marie Hayden.

Both Service Canada and Public Works have declined repeated requests for an interview. In an email response to CBC, a Service Canada spokesperson said "a small number of clients may have seen another client's personal information due to an error in the program's coding … approximately 75 potential instances out of 85,000 transactions."

"As soon as we identified the issue, we shut down the system and worked with (Public Works and Government Services Canada) and the supplier to correct the problem."

No similar breaches

Service Canada said the Office of the Privacy Commissioner was briefed about this incident on Oct. 1. It also said it didn't spot any suspicious activity as a result of the two-day breach and there have been no similar breaches reported since.

But the government department is only now contacting people whose information was compromised.

For Kris Klein, a lawyer and privacy expert in Ottawa, the fact that the site had a glitch is unsettling, but not surprising. The government's reaction causes him concern.

"We see organizations all the time playing cavalier with our information," Klein said.

"In this particular instance, I can't imagine why it didn't result in the immediate notification to the privacy commissioner and the immediate notification to the individuals."

Both Klein and the Office of the Privacy Commissioner said this case shows why reporting privacy breaches should written info Canadian law. Currently, disclosing a privacy breach is optional.