CYFSA DECISION 26

A children’s aid society contacted the Information and Privacy Commissioner of Ontario to report privacy breaches under the Child, Youth and Family Services Act (the Act). The breaches involved 73 incidents of unauthorized uses of personal information by nine of its employees. In this Decision, I find that although the CAS did not have reasonable measures in place to protect personal information at the time of the breaches, it has since taken steps to effectively remediate the breaches. As a result, I find that a review of this matter under section 318(1) of the Act is not necessary.