A review by Canada's federal privacy commissioner has found passport offices failed to adequately protect consumers' personal information, noting passport applications were stored in clear plastic bags and sensitive documents were thrown in trash cans and recycle bins.

Jennifer Stoddart detailed the security shortcomings in her annual report to Parliament, tabled Thursday. The report also found several tribunal bodies adjudicating disputes posted sensitive personal information — including financial status and health — online.

"Given the high sensitivity of the personal information involved in processing passport applications, better privacy and security measures are needed," Stoddart said in a release.

"Unfortunately, the shortcomings we found raised the risk that Canadians' information could wind up in the wrong hands."

The audit of passport offices also found documents that had been shredded could be pieced back to together and open computer systems allowed too many employees access to passport files. The report suggested privacy training in the offices was insufficient. Both Passport Canada and the Department of Foreign Affairs and International Trade have since agreed to beef up privacy and security measures.

'Law-abiding citizens fighting for a government benefit should not be forced to expose the intimate details of their lives to everyone with an Internet connection.'—Jennifer Stoddart, Federal Privacy Commissioner

Stoddart also called for improved measures among adjudicating bodies including the Canada Appeals Office on Occupational Health and Safety, the Military Police Complaints Commission, the Pension Appeals Board, the Public Service Commission, the Public Service Staff Relations Board, the RCMP Adjudication Board and Umpire Benefits decisions.

A total of 23 complaints were filed against the bodies on the grounds that the boards posted personal information in their decisions posted online.

"This is private information," Stoddart said. "Law-abiding citizens fighting for a government benefit should not be forced to expose the intimate details of their lives to everyone with an Internet connection."