The Canadian Privacy Law Blog: Developments in privacy law and writings of a Canadian privacy lawyer, containing information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
The author of this blog, David T.S. Fraser, is a Canadian privacy lawyer who practices with the firm of McInnes Cooper. He is the author of the Physicians' Privacy Manual. He has a national and international practice advising corporations and individuals on matters related to Canadian privacy laws.
For full contact information and a brief bio, please see David's profile.
The views expressed herein are solely the author's and should not be attributed to his employer or clients. Any postings on legal issues are provided as a public service, and do not constitute solicitation or provision of legal advice. The author makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained herein or linked to. Nothing herein should be used as a substitute for the advice of competent counsel.
This web site is presented for informational purposes only. These materials do not constitute legal advice and do not create a solicitor-client relationship between you and David T.S. Fraser. If you are seeking specific advice related to Canadian privacy law or PIPEDA, contact the author, David T.S. Fraser.
Saturday, April 01, 2006
The Information and Privacy Commissioner of BC has released his report into the sale of backuptapes containing private records of British Columbians (for background, see: The Canadian Privacy Law Blog: Incident: British Columbia government actioned off surplus backup tapes with sensitive health information).
From the IPC of BC:
PRIVACY COMMISSIONER RELEASES REPORT ON SALE OF TAPES OF PERSONAL INFORMATION
FOR IMMEDIATE RELEASE
March 31, 2006
Victoria—Government mechanisms for the secure destruction of media containing personal information are inadequate and were in any event not followed, Information and Privacy Commissioner David Loukidelis found in an investigation report released today.
The investigation was conducted following reports in early March by The Vancouver Sun that 41 computer backup tapes had been sold by the provincial government. The tapes contained highly sensitive personal information on thousands of people, including information about medical conditions, mental illness, substance abuse, social insurance numbers, dates of birth and financial information. The Commissioner found that the tapes were mistakenly sent for sale during a reorganization of the Ministry of Employment and Income Assistance when a Vancouver regional office was closing down in 2005.
BC’s privacy law requires public bodies, and private sector organizations, to take all reasonable steps to protect personal information from unauthorized disclosure. “In this case,” the Commissioner stated, “whatever written policies or procedures were in place, reasonable security measures were clearly not taken. The many human errors and system gaps that our investigation detected and that the government’s own report confirms, fell far short of objectively reasonable security arrangements, bearing in mind the very sensitive and extensive personal information at stake, the relatively simple steps that could have been taken to ensure the safe and proper disposal of the personal information and the predictability of risk of disorder at the time of an office move.”
The Commissioner recommended the creation of central provincial government policy and responsibility for secure destruction of personal information. He also recommended that the provincial government adopt a strategy for encryption of sensitive personal information. “Citizens of this province have no choice in the matter when government collects or compiles our personal information,” the Commissioner stated. “Personal information security is a serious matter and the provincial government needs to commit resources and energy to restoring and then retaining public trust in the government’s handling of our personal information.” The entire report can be found at http://www.oipc.bc.ca/investigations/reports/InvestigationReportF06-01.pdf.
The Canadian Privacy Law Blog is licensed under a Creative Commons Attribution-Noncommercial-No Derivative Works 2.5 Canada License.