The incident happened in April but was only publicly reported Tuesday by the provincial chief electoral officer. Greg Essensa said the data on the drives wasn't encrypted, but was in a format that could only be accessed by proprietary provincial software or by a highly skilled programmer using commercial software.
"I'm deeply disturbed," said Ontario privacy commissioner Ann Cavoukian.
It's "the largest data breach that has occurred in the province," from either a public agency or a private sector business. The risk, she added, is someone could access personal information and steal peoples' identities.
It's not merely a black eye for the province. It's also an embarrassment because Cavoukain is known around the world as a privacy advocate.
"One of the reasons I was so disturbed is the data on millions of people was not encrypted," she added.