Investigation launched after government posts employee IDs, RNC officers in Sunshine List screw-up

Newfoundland and Labrador's justice minister says an investigation is underway, after the release of the province's first Sunshine List, when the government posted information officials had warned could put Royal Newfoundland Constabulary officers in danger.

"We're in the process of investigating exactly how this happened to find out what went on and, more importantly, to ensure this doesn't happen again," Andrew Parsons told CBC News late Friday afternoon. 

"I'm extremely disappointed and concerned."

• Rank-and-file RNC officers exempted from Sunshine List

The so-called Sunshine List includes the names, job titles and pay information of public servants making more than $100,000.

Government had agreed to a request from the Royal Newfoundland Constabulary Association (RNCA) to leave the names of officers off the list, but those names were included in public spreadsheets Friday.

Those spreadsheets also included employee IDs for hundreds of government workers — an apparent breach of the Access to Information and Privacy Act.

The main list of RNC officers posted online as part of the province's first Sunshine List included only identification numbers.

However, the spreadsheet for Workplace Health, Safety and Compensation Review Division had other tabs, including the unredacted list of RNC officers who made more than $100,000 last year — along with their names, badge numbers and employee IDs.

"I've been told that there are security measures in place to ensure nobody can use this information to access personal information," Parsons said. 

"Any kind of privacy breach, I'm concerned with. This is something that I take very seriously."

It also included 846 employee identification numbers for core government employees on the Sunshine List.

Jeopardizing officer safety

Friday morning, unaware that the names of RNC officers had been posted, the premier once again reiterated why that information shouldn't be released.

"It was best felt that those names, attached to the salaries, would actually jeopardize in some cases the safety of those officers. In no way did we want to do that," Dwight Ball told reporters.

The head of the RNCA didn't respond to a request for comment on Friday.

The government wasn't aware the information had been posted until it was contacted by CBC.

A CBC reporter had to explain to a government staffer where the information could be found on its website. Fifteen minutes later, the file was removed. Parsons confirmed the information was likely publicly available for about two hours.

The information also included some employees whose salaries aren't covered under the disclosure rules. For example, employees of the legislature aren't supposed to be part of the Sunshine List, but their full information was also included.

Apparent breach of act: privacy commissioner

"It certainly has the appearance of a breach," said Donovan Molloy, the province's information and privacy commissioner.

Molloy said the department had an obligation to review data before it's sent out to ensure personal information like employee ID numbers aren't included.

He said an investigation would need to look at what the potential misuse of this information could mean. However, he said it's much less serious than if the file had contained social insurance numbers.

In order to be charged, Molloy said the release of information would have to be willful, and right now it appears to have been accidental.

"I would be surprised if we don't get a complaint but, in any event, a complaint is not required for us to decide whether or not to investigate the matter," he said.

According to Molloy, his office frequently deals with inadvertent disclosure of personal information, but it's rare that it covers hundreds of people.

In a statement released Friday evening, Cathy Bennett, the minister responsible for the human resources secretariat, said the incident was caused by "human error."

"Appropriate measures will be taken to ensure this human error does not happen again," the statement reads.

A sentiment echoed by Parsons.

"I feel bad for anyone that makes a mistake of this magnitude ... but I don't worry too much about embarrassment by whoever's involved. I worry more about people's privacy, people's security and ensuring these things don't happen," he said.

"We all know that mistakes happen, human errors happen, but that doesn't mean that it is acceptable."