The Information and Privacy Commissioner of BC has released his report into the sale of backuptapes containing private records of British Columbians (for background, see: The Canadian Privacy Law Blog: Incident: British Columbia government actioned off surplus backup tapes with sensitive health information).

From the IPC of BC:

PRIVACY COMMISSIONER RELEASES REPORT ON SALE OF TAPES OF PERSONAL INFORMATION

FOR IMMEDIATE RELEASE

March 31, 2006

Victoria—Government mechanisms for the secure destruction of media containing personal information are inadequate and were in any event not followed, Information and Privacy Commissioner David Loukidelis found in an investigation report released today.

The investigation was conducted following reports in early March by The Vancouver Sun that 41 computer backup tapes had been sold by the provincial government. The tapes contained highly sensitive personal information on thousands of people, including information about medical conditions, mental illness, substance abuse, social insurance numbers, dates of birth and financial information. The Commissioner found that the tapes were mistakenly sent for sale during a reorganization of the Ministry of Employment and Income Assistance when a Vancouver regional office was closing down in 2005.

BC’s privacy law requires public bodies, and private sector organizations, to take all reasonable steps to protect personal information from unauthorized disclosure. “In this case,” the Commissioner stated, “whatever written policies or procedures were in place, reasonable security measures were clearly not taken. The many human errors and system gaps that our investigation detected and that the government’s own report confirms, fell far short of objectively reasonable security arrangements, bearing in mind the very sensitive and extensive personal information at stake, the relatively simple steps that could have been taken to ensure the safe and proper disposal of the personal information and the predictability of risk of disorder at the time of an office move.”

The Commissioner recommended the creation of central provincial government policy and responsibility for secure destruction of personal information. He also recommended that the provincial government adopt a strategy for encryption of sensitive personal information. “Citizens of this province have no choice in the matter when government collects or compiles our personal information,” the Commissioner stated. “Personal information security is a serious matter and the provincial government needs to commit resources and energy to restoring and then retaining public trust in the government’s handling of our personal information.” The entire report can be found at http://www.oipc.bc.ca/investigations/reports/InvestigationReportF06-01.pdf.

See also: globeandmail.com : B.C. data disposal process flawed, inquiry finds.

Privacy Security Health Records Medical Records Backup Tapes British Columbia Incident

Labels: bc, british columbia, health information, information breaches