Law360 Canada (October 30, 2026, 10:26 AM EDT) --
 |
| John L. Hill |
The Privacy Commissioner’s investigation into the Crime Stoppers data breach raises fundamental questions about data security, corporate accountability and the obligations of organizations entrusted with confidential information.
When an organization collects sensitive personal information, it must protect it. That responsibility does not disappear because the organization hires another company to store or manage the records.
The principle is straightforward. Its application, however, has become increasingly complicated as governments, businesses and nonprofit organizations rely on outside contractors to handle information that may be confidential, commercially valuable or personally dangerous if disclosed.
The reported breach involving Canadian Crime Stoppers programs offers a stark example.
muhammad sukron makmun: ISTOCKPHOTO.COM
A CBC News investigation found that information associated with more than 1.5 million Canadian tips, submitted over 25 years, was exposed in a cybersecurity breach. The compromised records reportedly included personal information about tipsters, people identified in allegations, victims, police officers and Crime Stoppers personnel.
The data was stored on a platform operated by P3 Global Intel, which is owned by the American company Navigate360. On Oct. 27, the Privacy Commissioner of Canada announced an investigation into Navigate360 to examine the security safeguards in place at the time of the breach and determine whether the company complied with federal private-sector privacy law.
The investigation is not a finding of wrongdoing. Its importance lies in determining whether the safeguards were adequate and whether the company followed the law.
Crime Stoppers is a network of nonprofit organizations that solicits anonymous information about criminal activity. Its credibility depends on protecting the identities of people who come forward.
The software company managing that information occupies a different position. Navigate360 provides a commercial service, and the Privacy Commissioner’s investigation is directed at its obligations under the
Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA.
The distinction is important because PIPEDA generally does not apply to nonprofit organizations, although it applies to organizations collecting, using or disclosing personal information during commercial activities.
It would therefore be premature to assume that Crime Stoppers and Navigate360 have identical legal obligations. The precise responsibilities of the parties must be assessed considering the applicable law and the facts established through the investigation.
Nevertheless, the broader accountability question is unavoidable. Organizations cannot sensibly treat the security of personal information as an issue that ends when a contract is signed. A contractor may perform the technical work, but the organization collecting information must take reasonable steps to determine whether its chosen systems and arrangements provide appropriate protection.
Cybersecurity expert Ali Dehghantanha of the University of Guelph said in comments to CBC that organizations can outsource operations, but not accountability.
That principle deserves attention throughout the public and private sectors. A law firm entrusting client files to an external provider, a hospital using a third-party records system or a company maintaining customer information in a cloud database all face the same fundamental question: are adequate protections in place, and is anyone checking? A contract is not a substitute for effective oversight.
The Privacy Commissioner’s office said its investigation would examine Navigate360’s security safeguards at the time of the breach. It also said it had contacted Crime Stoppers and Navigate360 to offer guidance and encourage steps to contain the breach, reduce risks to affected individuals and prevent future incidents.
Those are important objectives. But the inquiry should also focus public attention on the standards that ought to apply when organizations handle exceptionally sensitive information.
The potential consequences of exposing Crime Stoppers records are particularly serious. The database was not simply a collection of names and addresses. It included information connected with criminal allegations, investigations and people who may have feared retaliation.
The sensitivity of information should influence the level of protection it receives. Systems holding such records should be designed with the consequences of unauthorized access in mind.
The investigation must determine what security measures were in place, how the breach occurred, what information was affected, and whether the safeguards met the applicable legal standard. Until those questions are answered, it would be inappropriate to conclude that Navigate360 violated PIPEDA. The reported scale of the exposure makes independent scrutiny essential.
The breach also raises a basic question about data retention. CBC’s cybersecurity experts questioned why decades of historical tips remained in the database. Their concern is well founded: information that no longer serves a legitimate purpose creates risks without necessarily providing corresponding benefits.
There may be valid reasons to retain some records. Investigations can remain active for years, and information may be relevant to later proceedings or reviews. The appropriate retention period will depend on the purpose for which the information was collected and any applicable legal obligations. However, retention should not be indefinite by default.
Organizations should identify what information they need, establish defensible retention periods and securely dispose of records when the legitimate purpose for keeping them has ended. Where practical and appropriate, remove or separate identifying details from information that must be retained.
These measures do not eliminate the possibility of a breach. They reduce the information available to be stolen and limit potential harm if security fails. The principle is especially important when a single database accumulates millions of records over decades. The larger and more detailed the collection, the more attractive it may become to someone seeking information for fraud, extortion or intimidation.
Another concern is how Crime Stoppers will inform affected individuals. Crime Stoppers has said it is assessing the compromised records and expressed concern that notifying people without distinguishing tipsters from those named in allegations could create further risks. The concern is understandable. A poorly designed notification could inadvertently reveal a tipster’s identity or disclose the existence of a report to someone implicated.
Silence has consequences too. People cannot take reasonable steps to protect themselves if they do not know their personal information may have been exposed. A responsible response should therefore include a carefully designed process for assessing individual risks, notifying people where appropriate and explaining what protective measures are available.
Organizations should also communicate what they know, what remains uncertain and what they are doing to resolve the problem. An ongoing investigation may limit what can be said, but it should not become a blanket excuse for withholding meaningful information. Transparency is particularly important where an organization has encouraged people to provide information in reliance on a promise of confidentiality.
The Crime Stoppers breach reminds us that privacy is not protected by policy statements alone. It requires appropriate technology, limited access, meaningful audits, sensible retention practices and clear lines of responsibility.
It also demonstrates why the legal treatment of information held by contractors deserves careful attention. When personal information passes between a nonprofit organization and a commercial service provider, the public should not be left uncertain about who is responsible for securing it or what remedies may be available when something goes wrong.
The Privacy Commissioner’s investigation should help clarify the company’s compliance with federal law. Its findings may also offer lessons for other organizations that depend on outside providers to handle confidential information.
The central issue is not whether every data breach can be prevented. No security system can guarantee absolute protection. The question is whether organizations take reasonable, proportionate steps to protect the information entrusted to them, recognize the risks of retaining it and respond responsibly when a breach occurs.
For Crime Stoppers, the stakes are unusually high because anonymity is central to its public purpose. For other organizations, the same underlying principle applies: people should not be expected to surrender control of sensitive information without meaningful safeguards.
When an organization asks for trust, it must be prepared to demonstrate that the trust is justified. When that trust is breached, accountability must mean more than regret. It must lead to answers, corrective action and protections strong enough to prevent the same failure from recurring.
This is the second instalment of a two-part series. Part one:
When Crime Stoppers can no longer promise anonymity.
John L. Hill practised and taught prison law until his retirement. He holds a JD from Queen’s and an LLM in constitutional law from Osgoode Hall. He is also the author of Pine Box Parole: Terry Fitzsimmons and the Quest to End Solitary Confinement (Durvile & UpRoute Books). His most recent book, Acts of Darkness
(Durvile & UpRoute), was shortlisted as one of five nominees for the Crime Writers of Canada’s Brass Knuckles Award for Best Nonfiction Crime Book.
Contact him at johnlornehill@hotmail.com.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of the author’s firm, its clients, Law360 Canada, LexisNexis Canada or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
Interested in writing for us? To learn more about how you can add your voice to Law360 Canada, contact Analysis Editor Peter Carter at peter.carter@lexisnexis.ca or call 647-776-6740.