Privacy watchdog slams Nunavut for failure to report breaches
Nunavut’s mid-1990s info-privacy law now obsolete, Elaine Keenan Bengts says
Though Nunavut government bodies commit breaches of privacy “every day,” many of them go unreported, contrary to what territorial legislation requires, Nunavut’s information and privacy commissioner, Elaine Keenan Bengts, says in her 2018-19 annual report.
“Misdirected faxes, lost mobile devices (including jump drives, laptops, tablet and cell phones), gossiping, snooping, excessive collection of information—all of these things happen every day,” Keenan Bengts said.
Many of those breaches amount to what the Access to Information and Protection of Privacy Act describes as “material breaches,” which include improper use or disclosure of health, financial or social information.
The law says those material breaches are supposed to be reported to the information and privacy commissioner, and that the affected people must be informed.
But Keenan Bengts said that’s not happening often enough.
“When the public is not aware that their personal information has been collected, used or disclosed in an inappropriate way, they are unable to defend themselves from misuse of that information,” she said.
She went on to say that to receive services, people have no choice but to share large amounts of sensitive personal information with government to obtain services related to things like health, education, social benefits, taxation and workers compensation.
At the same time, the disclosure or improper use of such information can cause financial, social, emotional and even physical harm.
That’s why it’s important for governments to notify affected people when such breaches occur, she said.
“Privacy is important. It is foundational to the ability of the public service to serve citizens,” Keenan Bengts said.
In her report, Keenan Bengts said she did receive 10 notifications of privacy breaches, five complaints of privacy breaches, and that she initiated work herself on three privacy-related matters.
But the number of breach notifications is still too low, she said.
As for Nunavut’s Access to Information and Protection of Privacy Act, she said it’s now obsolete and that Nunavut MLAs must review the act with a view to modernizing it.
The current legislation was written in the middle of the 1990s and came into effect in 1997. After the division of the Northwest Territories in 1999, the Nunavut territory inherited it.
She said that although some people at that time had heard of a “thing called the internet,” digital communications and record-keeping barely existed.
“We were still a paper-based society,” Keenan Bengts said.
Artificial intelligence didn’t exist either.
“There was no Siri and no Google. It took time and effort to obtain information. It was also much easier to maintain your privacy, because paper was difficult and time-consuming to track,” she said.
But now, people expect instant gratification when seeking information from governments and expect far more from them in the sharing of information.
Also, a vast amount of information about people is collected and turned into commodities to be bought and sold.
“Governments are some of the most prolific collectors of personal information and in circumstances which often do not afford the public a choice as to whether or not to participate,” she said.
In view of all that, she said Nunavut should take a good long look at modernizing its information and privacy legislation.
But implementing a new information and privacy law will require leadership, and that seems to be lessening in Nunavut, she said.
On information requests, she said the growth of a corporate culture inside the GN is reducing compliance with the general purpose and intention of the legislation.
“Leadership is key in this and, as noted in last year’s annual report, leadership in this regard has been waning over time. This needs to change,” she said.
She also pointed out that, with the exception of British Columbia, Nunavut is the only jurisdiction in Canada that does not have specific health privacy legislation, and even B.C. has other pieces of legislation that address health privacy.
The information and privacy commissioner is an officer of the legislative assembly and reports directly to MLAs and not to the GN.
Keenan Bengts began her first five-year term as information and privacy commissioner for the N.W.T. in 1997.
When the division of the N.W.T. occurred on April 1, 1999, she became Nunavut’s information and privacy watchdog as well and has served both territories in that role ever since.
But she plans to retire in May 2020. That means the legislative assembly must recruit and appoint a new information and privacy commissioner next year.