The federal Immigration, Refugees, and Citizenship Canada (IRCC) department potentially has a privacy breach on its hands, as the agency erroneously sent emails to the wrong recipients.

The department instructed expired and soon-to-expire Post-Graduation Work Permit (PGWP) holders and Temporary Residence to Permanent Residence (TR2PR) applicants to wait for an email, which would contain instructions on how they can extend their status. Those emails, however, ended up being sent to other unrelated individuals.

In a statement to CIC News, IRCC said that it was first aware of the privacy breach on August 03, one day after it had announced that PGWP holders can apply for a new open work permit. The emails were meant to advise clients that they may be able to update their work permit with a longer validity date, or to give them an opportunity to opt-out of the extension.

But the emails ended up being sent to the wrong addresses; each email contained permit holders’/applicants’ names, application numbers, and unique client identifiers.

“As is the case for privacy breaches, an investigation into this incident is currently underway,” the IRCC said in a statement. We are taking precautions and have appropriate measures in place to ensure security of information. Once all affected clients have been identified, clients will be sent an email with the correct information.”

The department has advised affected individuals to wait for a separate email notifying them of the breach. Those who received the IRCC emails by mistake have been advised to delete the messages.

“A separate email will be sent to affected clients informing them of the privacy breach. We are advising clients NOT to share the incorrect email with others and to delete the email from their inbox,” the IRCC said. “Once the issue has been resolved, a notice of correction will go out to those affected, and the correct email message will be distributed.”

IRCC also confirmed with CIC News that the federal government “takes its privacy obligations very seriously,” and that it would take the necessary steps to protect the privacy of all those it serves.

“Canadians and those hoping to come here, and we regularly take action to ensure they are being met.”