P2013-ND-03

On November 23, 2012, the Organization was notified by an employee that he
had been contacted by an unidentified coworker who had commented on the
employee?s earnings. The Organization investigated the matter and determined the following:
– The personal information at issue was inadvertently stored on a
network drive accessible to 435 employees in British Columbia
and Alberta. The personal information may have been accessible
on the drive since 2007.
– Between April and November 2012, at least 8 employees accessed
documents containing the personal information. The Organization
confirmed this using a Microsoft Word feature which tracks
documents recently accessed.
– The Organization is unable to confirm whether or not any other
access occurred as no system audit capability was implemented.