Nova Scotians need better notification of privacy breaches, report says

The annual report from Nova Scotia's privacy commissioner says the time has come to modernize the province's access to information laws.

For the first time ever, office initiated an investigation into a privacy breach by a government department

Tully says her office has also been able to tame the backlog of requests. (iStock)

Nova Scotia's privacy commissioner is calling for changes to make sure people are notified when their private information is compromised. 

In her annual report, Catherine Tully called it "a significant shortcoming of our laws" and expressed concern Nova Scotians aren't hearing about privacy breaches.

"Breaches are happening everywhere, they're happening in business, they're happening at all levels of government all across the country and around the world," she said.

"It's the snooping by employees, it's the unauthorized sharing, the theft of personal information."

Plenty of breaches happening

Currently, the province isn't required to give notice to individuals when a government department has committed a privacy breach, but Tully said plenty of them are happening.

She looked at other jurisdictions where government privacy breaches are reported and studied their numbers. From there she was able to put together a per capita rough estimate for Nova Scotia.

"If breaches were reported here, based on population, then roughly there would be probably 10 significant breaches in 2015 and up to as many as 154 breaches, just generally," she said.

Progressive Conservative Party Leader Jamie Baillie said he's not shocked by those numbers.

"It's not a surprise because it's a secret, and that's the problem," he said. "I think Nova Scotians, they expect their private information to be treated with respect."    

Breach by premier's office

Tully noted that for the first time ever, her office initiated an investigation this past year into a privacy breach by a government department, the premier's office.

It was in response to the premier's former chief of staff, Kirby McVicar, revealing health information about Independent MLA Andrew Younger to the media.

After the investigation, Tully's report made six recommendations, including appointing a chief privacy officer to "provide strategic privacy leadership" across government.

Review officer Catherine Tully said caseloads jumped 41 per cent in 2015-16.

Tully said caseloads jumped 41 per cent in 2015-16, including a 17 per cent increase in reviews and complaints.

Last year, Tully said more needs to be done to educate people about the Freedom of Information and Protection of Privacy Act and speed up the process of getting information to applicants. This year, she said outreach was one of their major successes with a 569 per cent increase in consultation requests.

Tully said as a result of meeting with hundreds of government officials, she will be developing and offering training to public bodies on how to recognize a privacy breach and manage it properly.

"Many of them talk about the fact that they are concerned they don't have enough training to recognize a privacy breach and they don't know what to do when a breach happens," she said.

Backlog progress

Tully says her office has also been able to tame the backlog of requests.

Requests for information are supposed to be resolved within 30 days, but last year, the average wait time to close a file that had been sent to her office for review was two years.

In Tuesday's report, she said once files were assigned, staff resolved matters, on average, within 65 days.

Tully admits her office is strapped for cash and at times understaffed, but Baillie said more money isn't necessarily the solution.

"We have to get to the root of why so many Nova Scotians resort to formal freedom of information requests," he said.

"If the government wasn't so secretive in the first place, you might actually see a reduction in that backlog through greater transparency to begin with."

The system is improving

But Justice Minister Diana Whalen said recent efforts by the government are already benefiting the system.

The government has consolidated most of the people who deal with information and privacy requests in one area and offered them enhanced training.

"I see us getting better and better because of the centralization of our service and the standardization of all of our policies and procedures."

The minister said people are already notified of breaches if it has an impact on them and she isn't sure if Tully's office needs to be made aware in each of those cases. While Tully said increased demands for her office's services are creating a strain on resources, Whalen said there would be no increased allocation.

With files from Michael Gorman

Comments

To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.