N.S. privacy commissioner says persistent lack of government support a 'major disappointment'

Nova Scotia's privacy commissioner says the provincial government's continuing lack of support for her office is a "major disappointment."

Tricia Ralph made the comments in the Office of the Information and Privacy Commissioner's annual report, which was released on Thursday. The 28-page document cites insufficient staffing and a quickly growing backlog of open files, and says they have not seen any improvement when it comes to shoring up inadequate resourcing.

"An unsurprisingly major disappointment this year was that we did not receive the additional permanent staff we asked for and very much need," Ralph said in the report. "To be blunt, I am being conservative when I say that our ability to provide our mandated services is significantly hampered by our insufficient resourcing."

Though the office's backlog looked to be levelling off last year, the report said on March 31, 2024, it had 700 files, up from the 479 files on April 1, 2023.

"We have exceeded the limit of our ability to keep pace with utilization of our office. We have asked for more staff every year and have been denied each time," the report reads.

In fact, the lack of resources affected the office's initial plan for the report, which was intended to be longer and include more information about its work over the past year.

"It quickly became clear that it would be counterintuitive to spend even more time away from file work to express how much time is taken away from working on files," the report reads. "Who's got time for that?"

This isn't Ralph's first request for more staff. The 2023 annual report also referenced pressures that prevented her office from doing its job properly.

Most of the cases on file involve claims that "a public body has withheld information and the applicant believes that they are entitled to it," with some of those cases dating back to 2019, the report said.

The office's thin resources were particularly stretched by the MOVEit cybersecurity breach that was reported last summer. Due to the breach, the office received more than 100 privacy complaints and fielded around 700 calls. Very few of those calls, however, were people looking to file a complaint. Instead, most callers were looking to speak to the Nova Scotia government.

"The MOVEit cybersecurity breach resulted in 110 new privacy complaints in four months, compared to an average of 10 per year in past years. No additional resources were provided to our office to address the biggest privacy breach in the history of our province," the report noted.

Office calls for changes to FOIPOP laws

The report also says the province's privacy and information laws are "outdated" and need an overhaul.

"The Freedom of Information and Protection of Privacy Act (FOIPOP) is 30 years old, and has not been substantively updated during that time, despite great advances in technology since 1994," Ralph wrote. 

"We need legislative change because our laws are not modern enough to adequately protect the access and privacy rights of Nova Scotians.… Now is the time to amend these laws."

Ralph said quickly-moving advancements in generative artificial intelligence and other data-driven technologies can be beneficial but also come with great risk.

"In this context, transparency and protection of personal privacy are more critically important than ever," Ralph said.

In 2023, Brad Johns, the justice minister at the time, launched a review of the FOIPOP legislation that included an internal working group reviewing past recommendations from the privacy office.

And earlier this year, Ralph's office made a 47-page submission to the provincial committee tasked with reviewing the FOIPOP Act and in the annual report, she noted she was "happy" to learn the legislative review would address the entire "legislative scheme."

One key legislative issue the report highlighted is frequent and repetitive applicants. It said in the past year, one applicant filed 31 requests for review over the span of 12 months. Meanwhile, the office normally gets an average of 161 review requests in total in a year.

The office is asking that the reviews are limited to five per person at one time and is also asking for the power to deem filing these reviews as "frivolous or vexatious," with the hope it will free up resources.

Toby Koffman, a spokesperson for the Justice Department, said in an emailed statement that in the fall of 2023, a website was developed to invite public feedback related to access and privacy legislation, along with the inter-departmental working group. 

Koffman said since then, the privacy office along with "provincial government departments, municipalities and villages, other public bodies, and the media" have been engaged in conversation about improving legislation.

"In total, more than 100 submissions were received, and 12 meetings were held," he wrote.

He added that engagement efforts will continue for the 2024-25 year, with amendments to the act brought forward by 2025.