Canadian air-transport security authorities are collecting too much information about some travelers and not handling it properly.

The Canadian Air Transport Security Authority went “beyond its mandate” in collecting passenger information unrelated to security, said federal Privacy Commissioner Jennifer Stoddart. Stoddart’s findings were based on an audit her office conducted of the agency’s privacy policies and practices.

CATSA officials gathered data and contacted police about passengers carrying large sums of cash on domestic flights, even though it’s not illegal to carry such sums, she said the audit found.

As well, incident reports and personal information gathered by CATSA weren’t always properly safeguarded.

“Documents containing sensitive personal information were left on open shelves and in plain view in a room where passengers may be taken for security checks,” Stoddart said in the statement.