The incident happened in April but was only publicly reported Tuesday by the provincial chief electoral officer. Greg Essensa said the data on the drives wasn't encrypted, but was in a format that could only be accessed by proprietary provincial software or by a highly skilled programmer using commercial software.

"I'm deeply disturbed," said Ontario privacy commissioner Ann Cavoukian.

It's "the largest data breach that has occurred in the province," from either a public agency or a private sector business. The risk, she added, is someone could access personal information and steal peoples' identities.

It's not merely a black eye for the province. It's also an embarrassment because Cavoukain is known around the world as a privacy advocate.

"One of the reasons I was so disturbed is the data on millions of people was not encrypted," she added.