Canadian privacy watchdogs powerless to hold Crime Stoppers accountable for data breach
Canada, Ontario privacy commissioners say legal gap means Crime Stoppers cannot be investigated
In the wake of a data breach exposing decades of Crime Stoppers tips that a legal expert called "one of the worst breaches in Canadian history," both federal and provincial privacy watchdogs have suggested their hands are tied.
uncertain
hands → hold → history
The true scale of the hack was revealed by an exclusive CBC investigation, which found that more than 1.5 million Canadian tips submitted to Crime Stoppers programs across the country over the past 25 years were compromised.
asserted
tips → reveal → years
More than 850,000 tips — about half of all Canadian records identified — included personally identifiable information.
asserted
tips → identify → information
We could not determine in every instance whether the information belonged to a tipster, a victim or someone accused of a crime.
uncertain
information → determine → crime
Hackers stole the data last March from Navigate360, a U.S. third party that Crime Stoppers hired to manage and secure its anonymous tips.
asserted
Stoppers → steal → tips
But CBC has learned that neither the Office of the Privacy Commissioner of Canada (OPC) nor the Information and Privacy Commissioner of Ontario (IPC) can formally investigate Crime Stoppers for failing to protect tipsters' personal information, due to a glaring gap in Canada's privacy laws.
asserted
Office → learn → laws
The federal private-sector privacy law applies to organizations that collect, use, and disclose personal information in the course of commercial activities, the OPC told CBC News in an email — but it "generally does not apply" to not-for-profit organizations like the Canadian Crime Stoppers Association (CCSA) or its local chapters.
asserted
it → apply → Association
Ontario's privacy watchdog also said it does not have the authority to investigate the breach, as it only oversees public-sector privacy law.
asserted
it → say → law
The Ontario privacy commissioner said it had already identified this exception "as a significant gap" in 2021, when it called for the adoption of a provincial private-sector privacy law that would more clearly cover the not-for-profit industry.
asserted
that → say → industry
"The significant volumes of data held by the not-for-profit sector in Ontario are not immune from privacy and security vulnerabilities, yet they remain largely unprotected by federal privacy law," reads the 2021 report, which urged the Ontario government to fix the gap immediately.
asserted
which → hold → gap
"No regulator has been given responsibility for this sector."
asserted
regulator → give → sector
The issue was first raised in a copy of a CCSA internal memo that CBC News obtained on Thursday.
asserted
News → raise → Thursday
The June 18 document, signed by CCSA president David J. Forster, urges all chapters to follow a number of guidelines in the wake of the data hack.
asserted
document → sign → hack
He advised all chapters to direct media inquiries to the CCSA, and not to contact privacy watchdogs.
asserted
He → advise → watchdogs
"We currently do not believe that you are required, nor should you contact the privacy commissioner in your region at this time," instructed Forster, saying his organization has "previously assessed that they [the commissioner] do not have jurisdiction over Crime Stoppers."
asserted
they → believe → Stoppers
Crime Stoppers had 'potentially one of the most harmful data breaches' Canada has seen.
asserted
Canada → have → breaches
- Exclusive
More than 1.5 million Canadian Crime Stoppers tips leaked, CBC exclusive finds
CCSA has not responded to CBC's previous request for comment on the contents of the memo.
asserted
CCSA → leak → memo
Cybersecurity expert says Crime Stoppers board could be liable
The legal gap leaves tipsters whose information was exposed with few options for answers.
uncertain
information → say → answers
Still, a lack of formal privacy oversight might not spare the organization or its local chapters from legal threats, said Claudiu Popa, a certified cybersecurity professional with privacy consulting firm Data Risk Canada.
uncertain
Popa → spare → Canada
"The accountability trickles up.
asserted
accountability → trickle → ?
Where does it go?
asserted
it → go → ?
It goes to the board of directors," Popa said.
asserted
Popa → go → directors
"
Crime Stoppers is best known for its public appeals, often partnering with police, for help with unsolved crimes and to advance investigations — all with the promise of anonymity for tipsters who contact them. (Tyson Koschik/CBC)
asserted
who → know → them
Popa stressed that the CCSA built its legitimacy on a promise of anonymity that it has now broken.
asserted
it → stress → that
Regardless of the organization's non-profit status, its leaders could face lawsuits, he said.
uncertain
he → face → lawsuits
"Here's an organization that has made certain claims and these claims established its legitimacy.
uncertain
claims → make → legitimacy
Those claims proved to be false and therefore this organization could be considered to be illegitimate right back to Day 1.
uncertain
organization → prove → Day
Ex-Ontario privacy watchdog
Ann Cavoukian, who served an unprecedented three terms as Ontario’s privacy commissioner, was stunned to find out that the CCSA had advised its local chapters against contacting privacy watchdogs.
asserted
CCSA → serve → watchdogs
"This is appalling!" Cavoukian wrote in an email to CBC News.
asserted
Cavoukian → write → News
"I’m not sure if privacy commissioners have jurisdiction here, but if I was still the privacy commissioner, I would go after these folks regardless!
asserted
I → ’m → folks
This shouldn’t be happening."
asserted
This → happen → ?
In a Friday press release, Navigate360 confirmed its systems had been breached between November 2025 and March 2026 — its first public acknowledgment of the hack, seven months after it happened.
asserted
it → confirm → hack
Cavoukian also called the organization's apparent failure to de-identify or encrypt its data outrageous, adding that employing a third-party company to manage its information doesn't make the group any less liable.
"
asserted
group → call → information
You don't just flip your hands and say, 'Well, you know, there's nothing we could do about it.'
uncertain
we → flip → it
No, you do that at the outset.
asserted
you → do → outset
The walls should go up; the data should get protected."
asserted
data → go → ?
The Office of the Privacy Commissioner of Canada said it "has reached out to Crime Stoppers in order to offer expertise and guidance with regard to responding to [its] privacy breach."
asserted
it → say → breach
It has also contacted Navigate360 "to obtain more information and determine next steps" and to "ensure that the organizations are taking the necessary steps" to protect Canadians' personal information.
asserted
organizations → contact → information
The OPC added that it has not received any complaints about the matter.
asserted
it → add → matter
The Aporia
