Privacy commissioner opens review of GN’s handling of sensitive mail
Graham Steele cites concerns over privacy risks of misdirected and lost mail after last year’s Canada Post transition in Iqaluit
Issues of mishandled or lost sensitive government mail after the opening of a second Canada Post outlet in Iqaluit last year has led the territory’s information and privacy commissioner to launch a review. (Photo by Jeff Pelletier)
Nunavut’s information and privacy commissioner is undertaking a review of the Government of Nunavut’s plan to protect sensitive information in the mail it sends out.
Graham Steele’s concerns were sparked by changes to the way mail is delivered in Iqaluit after a new post office opened in the city in October.
Residents complained of delayed or lost mail and confusion around a new system that required them to switch from using a post office box number to a civic address, which was then associated with a new box number.
Steele initially set a Jan. 17 deadline for three GN departments — Finance, Family Services and Human Resources — to assess the risk of privacy breaches and explain how they are acting to prevent them.
He extended the deadline to Jan. 24 because of last week’s devolution signing agreement between the territorial and federal governments and Nunavut Tunngavik Inc.
Steele shared a reply he received Tuesday from Anna Fowler, the deputy minister of executive and intergovernmental affairs, with Nunatsiaq News.
In it, she acknowledged a “heightened risk” around mail security “as evidenced by numerous reports on social media and firsthand experiences of our staff.”
“This is a first-of-its-kind situation for us, we do not typically encounter privacy risks that have the potential to affect services across all bodies,” Fowler said.
She said the issue seems to be localized to Iqaluit.
Fowler outlined actions the departments will take, including the creation of a dedicated channel on their websites for public notices as well as internal bulletins to promote awareness of privacy matters.
Her department has not received any reports of privacy breaches, she said, and it “appears that mail not belonging to the recipient is being responsibly returned to Canada Post or forwarded to the intended recipient.”
But what Steele asked for in December was an assessment of the privacy risks created by the Canada Post change.
Responding to Fowler’s letter, Steele wrote, “Given the lack of detail, I can only assume that risk assessments and mitigation plans have not been completed.”
Additionally, he noted that he asked the Finance Department to explain how records of GN employees living in Iqaluit would be updated to reflect their new addresses, since that department maintains the employee compensation database.
“Your letter indicates that all deputy ministers have been asked to submit information about postal privacy risks, and [Executive and Intergovernmental Affairs] is still gathering that information,” Steele said.
The review will examine GN practices for delivering sensitive information and how it plans to mitigate the risks of mail being lost or misdirected.
Examples of sensitive mail coming from those departments includes pay and tax slips, income assistance, workplace matters, and health cards.
Steele said he aims to have the review and a final report completed prior to his appearance at a legislative assembly standing committee meeting at the end of April.
He said he is interested in hearing from anyone who has a story to share about lost or misdirected sensitive GN mail. He can be reached by email at admin@atipp-nu.ca.
I don’t know why the Government of Nunavut would do a privacy impact assessment on something outside of their control and I don’t know why Graham is investigating something outside of his mandate. Is he bored? Maybe he should focus on his actual role instead of making a failure of a federal body the Government of Nunavut’s fault.
My guess is Graham is annoyed at being personally inconvenienced and is looking for an outlet for his frustration.
When your address changes, you have a personal responsibility to notify people who send you mail, it’s not the GN’s role to tell people that. Just like you have to notify your bank, and anyone else that sends you mail that your address is changed, you have to tell your employer.
“I don’t know”
… no kidding
You’d think that the Federal Commissioner would ask the same questions of Canada Post.
.
Everyone knows to update your address, but the GN has not indicated how it plans to address this with employees and others who it sends mail to. What is its process for RTS mail, if any? What policies exist?
.
The answer seems to be there’s nothing in place. To Steele is looking into it to provide recommendations, since clearly the GN needs some help.
.
Look up when a privacy impact assessment needs to be done under the legislation and you can see it is pretty broad.
.
for years I received an individuals collections notices from QEC. For two years i sent RTS. I don’t bother anymore because they keep coming back.
So, I looked up the provision, and it states that a Privacy Impact Assessment is necessary for a new program or the redevelopment of a program… remind me, what program is the GN responsible for here? This is a federal program, the federal version of the IPC should intervene.
The GN doesn’t need to address this with people who it sends mail to, employees need to put in changes of address. It’s annoying that the mail forwarding we were promised isn’t working, but that:
A) isn’t the GN’s fault; and,
B) doesn’t mean that changes of address don’t need to be done by individuals.
Just because a thing happens in Nunavut, it doesn’t mean the GN is to blame.
The programs are giving notice to employees, debtors or others in relation to benefits. The GN has obligations with respect to personal information, so it needs to assess when things change. Since the mode of delivering (mail) is changing, the GN is changing how it provides the program and was supposed to assess.
.
If the answer was they have processes to deal with the changes being imposed by Canada post then done, but it sure seems like they didn’t have any plan. It could be as simple as having a policy that the GN will no longer send notices to P.o. boxes effective January 1. But they seem to have nothing at all and are playing catchup.
Thanks for your anonymous comment. It gives me the chance to repeat (it’s in the headline and the article) that I am reviewing the GN’s handling of the addressing change, not the addressing change itself. Canada Post is not within my jurisdiction, but the GN is. I have a statutory duty to ensure citizens’ private information held by the GN stays private.
While I agree it is an individual’s responsibility to notify their employer of an address change, this situation is different: every resident of Iqaluit has had their mailing address changed, all at the same time. Residents have multiple points of contact with the GN (e.g. as employer, or for licences, permits, health cards, income assistance, etc.). There is a real risk of sensitive mail not getting to its intended recipient. Was the GN ready? If not, what is it doing to get ready? That’s what I’m reviewing.
Graham Steele
Information and Privacy Commissioner
Thank you for the kind and not at all passive aggressive kind words. I can however read, but I am still confused as to what you expect the GN to do about something outside of their control. I guess they could send a reminder/PSA out regarding the change, but honestly, they should have also been able to trust a crown corporation with a multimillion dollar foot print could handle basic mail forwarding to a small community of less than 10,000 people. It would have been inappropriate for them to plan for the failure of an organization several times larger than themselves.
As for moving to electronic methods, you’ve now lived here for a few years, you must know that many people still don’t have access to internet in the home and that physical mail remains one of the few ways to contact many people?
Maybe you should be bugging your federal counterpart to intercede instead of the GN.
It’s clear you have settled on an answer and will hear nothing contrary.
Let me give you a question for them to address in an impact assessment:
.
What happens to the 10,000 GN letters being sent to P.o. boxes. Where does it go?
.
What happens when GN gets a letter RTS? How do they deal with it?
ATIPP Commissioner: How were you planning on sending people their own personal information?
GN: We were going to use a Crown corporation that is legally empowered to provide precisely that kind of service, and has been doing it for as long as anyone can remember.
ATIPP Commissioner: Hmmm… sounds risky.
Yes, it is folks’ responsibility to update addresses when things happen, like the post office changing all of our post office boxes to street addresses, as was done before Christmas. I can tell people that my NU health card expired end of December, apparently a new card was sent to me around the time that the post office was changing (my mail now comes to the Frob building), and I have never received my updated card. I found that out this past week at the hospital – oh, look at that, my health card has expired. Is this my responsibility to let the GN (that is not my employer, by the way) know that my address was changed, in order to get my updated health card?
Privacy, privacy, privacy. is this all GN? Come reveal to us what is going on besides hiding beside privacy….GN one big joke. I know more about Putin then I know about GN…..