B.C.’s information and privacy commissioner says he was surprised by the outlook of some senior Nanaimo officials during a recent investigation.
“I think that part of the Nanaimo issue that was so concerning to me and to my office, is that there were those in the senior levels of the city that did not seem to understand, appreciate and want to ensure that the privacy of information entrusted to those officials was properly protected,” Michael McEvoy said. “Both senior staff and at the council level.”
He said that he was not speaking about everyone serving at those levels.
McEvoy released a seven-page letter to the City of Nanaimo on Thursday outlining the results of a combined investigation into three reported breaches of information and privacy.
In two cases, investigators could not find out who was responsible for breaches. In one case, the office found that a councillor had posted on his Facebook page letters lawyers wrote to the city that were deemed confidential.
Coun. Gord Fuller said that he posted the letters on his Facebook page and removed them at the city’s request. He said he does not believe he did anything wrong.
A member of the public reposted the letters on Fuller’s page, he said. The City of Nanaimo, backed by McEvoy, who cited provincial legislation, has ordered that posting be removed.
When an unauthorized disclosure of personal information is reported, the public body or organization and leadership are usually responsible for remedying the matter, with oversight from the privacy office, McEvoy said in his report.
“However, in this case, the disclosure reports to my office implicated senior members of the city’s leadership, thereby casting doubt on the city’s ability to properly remedy the alleged breaches.”
McEvoy said he made his letter public because the breaches were widely discussed in Nanaimo and to remind municipal officers of their responsibility to protect privacy.
The City of Nanaimo has said in a statement it will implement McEvoy’s recommendations as soon as it can. They include setting up a privacy-management program and ensuring senior city officers understand privacy obligations under provincial legislation.
Mayor Bill McKay said he had hoped technology would have helped find the source of leaks.
McEvoy said tracing the source of leaks can be difficult. For example, if someone passed along information in an envelope, “that doesn’t show up in, obviously, a computer necessarily.”
“So, we make our very best efforts and deploy our resources to investigate and try to get to the bottom of things. And in this case, as the report notes, we were not able to come to a conclusion that would hold up in court.”
Since April 2017, the privacy office has opened 38 files relating to Nanaimo, McEvoy said.
By comparison, his office received 16 files regarding Saanich and 14 related to Victoria during the same period, he said.
Of Nanaimo’s 38, nine were from the municipality reporting breaches of information. They included the three that were recently investigated.
McEvoy’s office is not finished with Nanaimo. There are eight remaining Nanaimo files.
Compared with five years ago, McEvoy said, there is a far greater understanding on the part of public and private bodies of the need to have a privacy-management program and to think about privacy in everyday work.
“That said, I continue to be surprised at the actual implementation of privacy practices on a day-to-day basis. It is not unusual for us to receive reports about unencrypted laptops or USB sticks that are in somebody’s possession in the back seat of their car that is broken into and stolen, which might contain all kinds of sensitive information,” he said.
“Properly securing personal information at the workplace or where it is being transported is really important and it requires ongoing vigilance.”
A Lantzville councillor recently misplaced a memory stick, which was not encrypted, containing in-camera information, but later found it in his laptop bag.
