Nunavut government not following access to information law, says commissioner
On a scale from 1 to 10, Graham Steele says he’d rate government’s performance ‘no higher than a 4’
Legal errors, outdated record-keeping systems and significantly under-reported privacy breaches within the Government of Nunavut are outlined in a new report by the territory’s information and privacy commissioner.
“If I had to rate the access and privacy system in Nunavut on a scale from one to 10, I would put it at around a four,” Graham Steele, the commissioner said in an interview. “No higher than a four.”
His office’s 2020-21 annual report was tabled in the legislative assembly on Sept. 9.
Steele’s role is to make sure the GN follows Nunavut’s Access to Information and Protection of Privacy Act.
All privacy breaches within the government are supposed to be reported to him, but Steele said he thinks many are going unreported.
At the heart of the problem is chronic understaffing and not enough training to follow the law, Steele said.
When a ransomware attack hit the GN in November 2019, the former commissioner was not notified.
Elaine Keenan Bengts eventually started an investigation into the breach, but nearly two years later, Steele is still looking into exactly what information was lost in the attack.
Another ransomware attack occurred in February, involving Edsembli Inc., the service provider that handles Nunavut school information systems, including grades, report cards and other student information.
Steele said he was not notified about the breach and learned about it through Nunatsiaq News, not the Department of Education.
“I shouldn’t have to read about it in the newspaper,” he said.
Steele gave examples of other investigations he opened in the report.
In one request made to Health about COVID-19 isolation hubs, Steele found more information could have been disclosed.
In the report, he said this shows “the GN’s inability or unwillingness” to release information when it’s not forced to by law.
In another case, two managers got personal information — including medical information — about a GN employee, and disclosed it to others.
Steele found there was no adequate investigation into the incident.
He also found personal health information needs to be handled better in community health centres.
In one case, a health centre employee looked at someone’s medical record for an unauthorized reason. In another, a child’s health chart — still kept on paper — went missing.
Steele said this is an example of Nunavut’s outdated record-keeping systems, including the one used for managing health records.
“Every other province and territory has updated the law to specifically deal with health information,” he said.
“There’s a great deal of our private personal information held by the health system.”
In 2020-21, the commissioner conducted reviews on 64 cases. These reviews looked into how much information a department disclosed when requested and whether a refusal to provide information was justified. It also summarized investigations of complaints about privacy breaches and other concerns.
The Department of Health had the most cases opened about them, with 24 files, but Steele said this is because it is following the rules correctly.
“I believe the Department of Health, [files reports] in every appropriate case,” he said. “They’re good at it, they understand it, and they get it.”
Other departments aren’t reporting everything they need to, so although their case numbers are lower, that doesn’t mean there are fewer privacy breaches, Steele said.
In Nunavut, the commissioner doesn’t have the power to order a department to release documents.
There are also no consequences for departments that withhold information illegally or don’t follow the rules of the information and privacy act, like providing information within a certain timeframe.
Steele said it would not cost the GN money to give him these powers, like commissioners have in other jurisdictions – it’s just a matter of changing the law.
“There is no reason for Nunavut to be so far behind,” Steele said.
This change was recently made in the Northwest Territories, and Steele recommends the Nunavut legislature also do so immediately.
Steele is on a five-year term as the commissioner, until January 2026.
On top of wanting to see changes to the territory’s privacy laws to make the GN more accountable, Steele would also like to see access to information law extended to municipalities. And he’d like to mentor an Inuk or long-term northerner who is fluent in Inuktitut to take up the position after him.
But to accomplish any of this, Steele said GN departments and members of the legislative assembly will have to be on board.