Right to Know Coalition disappointed by latest N.S. privacy breach

As the Nova Scotia government waits for answers about its latest privacy breach, the president of the Nova Scotia Right to Know Coalition is calling the breach very disappointing.

"One would like to think we had gone past the point where these basic mistakes would be made," Michael Karanicolas said.

Earlier this week, CBC alerted the province it had published an unknown number of decisions online from the Workers Compensation Appeals Tribunal (WCAT). The decisions were all originally rendered between 1998 and 2009.

Courts and quasi-judicial bodies routinely post decisions to the Canadian Legal Information Institute (CANLII) website, which is used frequently for legal research.

The names of workers and their employers were not redacted in the WCAT decisions, as required, meaning anyone could view their personal information — including everything from child sexual abuse to the medications and treatments they were prescribed.

"I would expect, first of all, some kind of mea culpa because — obviously — this was an egregious breach of standards," Karanicolas said. 

"It's a wrongful disclosure. It's not a breach in the sense that somebody hacked their system or somebody was using the system in a way that was inappropriate. 

"This is essentially the government publishing material that impacts people's personal privacy and that they shouldn't have put out there."

On Thursday, Nova Scotia Justice Minister Mark Furey said he wants to know what happened.

"I don't have to tell you any privacy breach is unacceptable," Furey said.

Furey said he is waiting for the investigation to determine how the breach happened, how many people were impacted and how to prevent it from happening again.

He said the province has followed all the protocols for the investigation, including reporting it to the privacy commissioner.

Karanicolas said he hopes there will be honest accountability about what went wrong.

He said he hopes the government does not respond the way it did to the 2018 breach of the FOIPOP website.

"What was very troubling about the response last time was this rush to blame anybody but themselves. Last time we saw them insisting that some kid who was using their website was the one to blame for their mistakes," he said.

Karanicolas said that deflected from the government's responsibility for not locking down the site.

He said the government should not use this as an excuse to reduce transparency, especially considering how closely it guards some information. 

"There is no question this government is very vigilant about safeguarding data when they are concerned it's going to impact an area of sensitivity to them," he said.

"Given the extraordinary level of vigilance they have toward safeguarding material that they see as sensitive when it suits their interests, I would hope to see a similar level of vigilance taken when talking about material that impacts the personal information of Nova Scotians."

Even though the government is not required to inform people their privacy has been violated, he said it should be their priority. 

That may take time, he said, since the decisions are older and contact information may have changed.