More than 1,400 people whose personal information was found by police in the home of a B.C. government supervisor last year should have been notified immediately — not seven months later, a new report says.

B.C. acting privacy commissioner Paul Fraser says the length of time it took to alert income assistance clients of the privacy breach was the “most significant failure” in the government’s response.

“It is clear, beyond any doubt, that affected individuals should have been notified within days of the April 7, 2009, discovery,” Fraser wrote in the report. “A seven-month delay in notification meant that any reasonable opportunity for risk mitigation was lost.”

Fraser also found that the government failed to properly protect clients’ information in the first place. Neither the Ministry of Housing and Social Development nor the Ministry of Children and Family Development had any idea that the supervisor had kept clients’ records at home for months, and sometimes years, without authorization. That should be fixed, Fraser said.

Fraser’s report follows a series of Times Colonist stories last year about the discovery of records in the Victoria home of Richard Ernest Wainwright, a supervisor in the youth and special-needs office of the Children’s Ministry.

Wainwright had a criminal record for counterfeiting offences and credit-card fraud, according to court records. He was also under RCMP investigation for allegations he might have used false identity documents in the name of Richard Ernest Perran to get his government job.

The RCMP found no evidence that clients’ personal information was compromised and Wainwright has not been charged with any offence. He was fired in October.

Fraser concludes that the government failed to create a “culture of privacy,” and that too many civil servants aren’t getting the message about the need to protect people’s personal information.

“The essential problem with the MCFD and MHSD responses to this breach was that an alarming number of government employees, ranging from investigators, to managers, to directors, did not recognize that there was a potential privacy breach,” Fraser wrote.

Of the 26 employees who could have flagged the privacy breach, only two recognized the problem, said Fraser. And those two failed to properly alert supervisors, he said.

The report recommends the government immediately create an executive position called the chief privacy officer, to act as a “bright light” on privacy issues for confused civil servants.

It would give government employees “a place where they can come and get some advice very quickly and get some direction in terms of where they should go in case an event occurs.” said Fraser.

Minister of Citizens’ Services Ben Stewart, who oversees the public service, was unavailable to respond to the report yesterday.

NDP critic Doug Routley said the government should move quickly to adopt Fraser’s recommendations. “The ministers need to step up and clearly take responsibility for this,” said Routley.

Fraser said he’ll await the province’s response. “We can clearly see the time has come, based on these events, to get on with doing something about it,” he said.

lkines@tc.canwest.com

rfshaw@tc.canwest.com