Nfld. & Labrador

Privacy breach in Corner Brook sent to commissioner's officer for review, next steps

An investigation into an information leak on the City of Corner Brook's website is in the hands of the province's privacy commissioner.

Information possibly accessed through city's website includes dates of birth, addresses of voters

The City of Corner Brook's website contained personal information that was breached.

An investigation into an information leak on the City of Corner Brook's website is in the hands of the province's privacy commissioner.

An analyst with the provincial office is looking into the report of the breach, and will help determine what the next steps will be for the city.

"We have the breach notification, and one of our analysts is reviewing it now and we may very well be going back to the city with some further questions," said Sean Murray, director of research and quality assurance with the Office of the Information and Privacy Commissioner.

"But what happens from there, I think it's too early to tell."

On Tuesday, the city reported that private information on its website was accessed by four different users. The directory on the website — not available through links on the site — contained information used in a previous voters' list, including name, address and date of birth of about 10,000 people. While the directory contains that personal information, the city says it does not know if the personal information itself was viewed.

When a breach is reported to the privacy commissioner's office, the affected body is asked to describe the breach, state what it has done to ensure the breach doesn't happen again and how it plans to notify those affected. After that, the office will decide if it needs more information, said Murray.

"We may then assess whether the public body has adequately addressed the situation or whether they may you know there may be further steps warranted."

Mayor Jim Parsons says he has faith the city's IT department. (Kody Gardner/CBC)

The office will also look into whether it believes there was malice in the intent of those committing the breach. That would also determine if law enforcement would need to get involved, although that's rare in breaches like this, he said.

Murray says the city took appropriate action in issuing a news release the leak affected more than a few individuals.

He also said anyone with concerns should contact the city, but if they are not satisfied with the response, he encouraged them to contact his office.

'Very diligent'

Once the breach was discovered, said Mayor Jim Parson, it was immediately dealt with, and all personal data on the list was removed from the server hosting the website.

"Our IT department is top-notch, very diligent, on top of these matters," Parsons said. "I have every confidence in them."

Parsons said the data available was considered "low harm" but he's glad the breach was noticed before it went further.

The city will implement a privacy audit for new software purchases and undergo further training of staff on privacy issues and employees requirements as it relates to the Access to Information and Protection of Privacy Act.

Read more from CBC Newfoundland and Labrador

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

undefined