Canadian passengers from virus-stricken Zaandam cruise ship hit by federal gov’t privacy breach

After enduring a cruise with a COVID-19 outbreak and four deaths, the 247 Canadian passengers who were aboard the Holland America Line ship, the MS Zaandam, face a new problem: a privacy breach by the federal government.

“Didn’t we go through enough? Now we have to have a breach too?” said passenger Margaret Tilley of Nanaimo, B.C. “I’m just very angry that they would allow something like this to happen.”

In a detailed email Global Affairs Canada sent Canadian passengers during the Easter holiday weekend, it explained that, “due to an administrative error,” it had mistakenly sent them an email on April 1 with an attachment containing personal information on each passenger — including their address, date of birth, email, phone number and passport number.

The Global Affairs notice about the breach advised passengers to monitor their financial accounts and request periodic credit reports from a national credit bureau to limit the risk of identity theft.

During the ill-fated Zaandam cruise, Global Affairs kept Canadian passengers updated on efforts to get them off the ship and back to Canada. The breach happened the day before the ship docked in Fort Lauderdale, Fla., on April 2 so passengers could disembark and return home.

Global Affairs told CBC News that after the breach happened on April 1, it “promptly” sent a follow-up email that same day, apologizing to passengers and informing them they could contact the department if they had questions.

Tilley said she didn’t notice either of the Global Affairs emails sent on April 1, because she was so preoccupied with the COVID-19 outbreak plaguing the cruise at the time.

She said she first learned about the breach on April 11, when Global Affairs sent her a more detailed notice on the matter which included advice on how passengers can protect themselves.

“That really upset me,” said Tilley. “Because if somebody is going to use your information, they’re going to use it right away.”

Passenger Wendy Mitchell of Victoria said she also didn’t fully understand the breach until she received the most recent email from Global Affairs.

On Saturday, Mitchell filed a complaint about the breach with the Privacy Commissioner of Canada.

“Just complete and utter disappointment in our government,” she said about the matter.

Who got the email?

Although each passengers’ personal information was sent to the 247 Canadians on the Zaandam, passenger Norma Kirkham of Victoria said that it was likely inadvertently forwarded to other people. In her case, she forwarded email updates from Global Affairs during the cruise to her concerned son in California.

“It only went out to the Canadians, but then how many of those people forwarded it to other people?” said Kirkham. “[If] that’s in the wrong hands, somebody now has enough information to take my identity.”

The Zaandam’s South American cruise began on March 7 with 1,243 passengers and 586 crew members. The ship ran into trouble after it tried to cut the cruise short in mid-March due to the growing global COVID-19 pandemic, but couldn’t secure an immediate place to dock and let people disembark.

Following a COVID-19 outbreak on the Zaandam in late March, four passengers died on board, and a crew member died shortly after the ship docked in Fort Lauderdale. None were Canadian, and four out of the five who died tested positive for COVID-19, according to a Reuters report.

Mitchell said she’s grateful to Global Affairs for helping Canadian passengers eventually get off the ship and return home. However, she wants the department to take more responsibility for the breach, such as offering to sign up passengers with a credit monitoring service, free of charge.

Mitchell and several other passengers CBC News interviewed also said that, because their passport numbers may now be compromised, they want Global Affairs to issue them new ones, or at least pay for the cost.

“They should have sent a letter that said … ‘We’re so sorry this has happened and this is what we’re going to do for you,'” she said.

Global Affairs stated in its most recent email to passengers that, in an effort to avoid another breach, it has created a small unit within its COVID-19 response team which will manage communications with Canadians abroad.

CBC