B.C. is falling behind other provinces and territories by failing to require mandatory reporting of privacy breaches, the province’s independent watchdog says.
Privacy Commissioner Elizabeth Denham said B.C. still relies on a “voluntary regime,” in which public and private bodies decide whether to alert her office or citizens about significant breaches.
As a result, Denham said she has no way of knowing whether she’s hearing about all serious cases or whether citizens and consumers are being properly notified.
“Citizens expect somebody has their back,” she said. “They also expect to be told when their information has been compromised and it may result in serious harm.”
Denham said the issue is becoming ever more critical as advances in technology allow sensitive data to be easily stored, transported and, on occasion, lost or stolen.
“It seems that not a week goes by without another high-profile story about hackers exploiting vulnerabilities in payment systems,” Denham said. “We hear about lost and stolen laptops, unencrypted USBs [memory sticks], employees that are snooping health records.”
The B.C. government responded to Denham’s concerns by stating that, as a matter of policy, it reports all serious privacy breaches to her office as soon as possible, including cases in which large numbers of people are affected or there is the potential for serious harm.
Government also provides Denham with a monthly update on all actual or suspected privacy breaches.
But Denham said private information is held by a wide array of other public bodies, including colleges, universities, school boards and municipal governments — all of which are subject to the same voluntary reporting regime.
She said 11 other jurisdictions in Canada have some form of legislative requirement to report privacy breaches in the public, private or health sectors.
“B.C. has none,” she said.
The issue is of particular concern when it comes to breaches of health information, since her office has found that health authorities report only about one per cent of privacy breaches, Denham said.
“That causes me grave concern, because I think our health information is the most sensitive information that is collected and used by public bodies.”
A special legislative committee issued a report in February recommending amendments to the Personal Information Protection Act that would require private companies to alert Denham and affected individuals of all breaches “where there is a real risk of significant harm.”
The B.C. government says it is considering the recommendation.
Alberta has similar legislation already, and the Canadian government recently updated the federal law to include mandatory reporting.
The B.C. Freedom of Information and Privacy Association, an advocacy group, said Alberta reports 70 per cent more breaches in the private sector than does B.C.
“Unless we’re just a whole lot more law-abiding than Albertans are, chances are it just means things aren’t getting reported here,” said Vincent Gogolek, executive director. “This is not good for the confidence people have in the providing their personal information; you want to know it’s protected and if something happens, measures will be taken.”
The B.C. Civil Liberties Association has been pressing for mandatory reporting since at least 2008, so people can safeguard their privacy. Micheal Vonn, policy director, said it’s a “basic” protection that should already be in place.
“The risk assessment should be [done by] the individuals, not the entity that is already looking to minimize their liability,” she said.
Denham said government should also amend the Freedom of Information and Protection of Privacy Act to require mandatory reporting by public bodies. That law is under review, and government said it welcomes the discussion.
