Investigation Reports

This report investigates the growth of “no responsive records” replies by the Government of British Columbia in response to the general access to information requests of citizens. It also reports on five specific instances of “no responsive records” replies to requests made to government relating to the September 2012 resignation of the Premier’s Chief of Staff.

This investigation report examines whether the Government of British Columbia is conducting employment record checks in compliance with FIPPA. The report also includes best practices for employment-based record checks, which will be of use to government as well as other public bodies.

This investigation report examines the privacy issues associated with the use of facial recognition technology by the Insurance Corporation of British Columbia (“ICBC”).

In response to a complaint about the practice of BC Ferry Services Inc. to publicly post responses to access to information requests, either before or at the same time as they are provided to the applicant, the Information and Privacy Commissioner for British Columbia conducted an investigation. The investigation examined both the practice of simultaneous disclosure as well as the general practice of proactive disclosure. On the key issue of simultaneous disclosure, the Commissioner recommended a minimum delay of 24 hours between the applicant’s receipt of the response and the time the response is publicly posted. There should be a further delay upon request by the applicant on reasonable grounds.

The electronic health record system at Vancouver Coastal Health Authority (“VCH”) known as the Primary Access Regional Information System (“PARIS”) was introduced in 2001 for its community-based programs. It is accessed by staff and contractors involved in the delivery of a wide range of health services outside of acute care hospitals. The personal information contained in PARIS is highly sensitive. It includes diagnoses as well as the case notes of physicians, nurses and counsellors about the treatment they provide to their clients. The purpose of this investigation is to evaluate VCH’s compliance with the requirements of FIPPA in its collection, use and disclosure of personal information in PARIS.

In April 2009, ICBC advised a trial court judge that an ICBC claims adjuster had provided personal information about the trial's jurors to the external defence counsel retained by ICBC for the trial. ICBC conducted its own internal investigation of all the jury trials that could be identified since 2000 and determined that there were five other similar incidents of jury checking. The OIPC's investigation reviewed ICBC policies and practices. While ICBC had policies in place to prohibit jury checking, those policies had not succeeded in preventing these occurrences. ICBC should focus on more specific training for claims adjusters and better communication and awareness of ICBC's privacy policies for external defence counsel.

Four computer tapes containing personal information of residents of British Columbia and New Brunswick who received medical services outside their home province was couriered from New Brunswick to Health Insurance BC, a contractor for the Ministry of Health in British Columbia. They never arrived at HIBC. The information was on magnetic tapes and was not protected by encryption. This method of transferring personal information did not meet the security measures required under s. 30 of the Freedom of Information and Protection of Privacy Act. The Ministry’s policies and practices resulted in failure to ensure the tape loss was detected in a timely way. The Ministry also failed to notify affected individuals and the OIPC in a timely way. After the loss was discovered, the Ministry took appropriate action to mitigate risk to the affected individuals. After the incident, the Ministry ceased exchanging unencrypted personal information of this kind with other jurisdictions. New Ministry procedures now monitor more closely such exchanges of personal information and the Ministry continues to work towards an even more secure method of data transfer.

An employee of EDS, a Ministry service provider, was caught improperly browsing through a Ministry computer system for personal information of friends and acquaintances. This had gone undetected because of insufficient technical security measures. The inadequate security measures constituted a breach of s. 30 of FIPPA. Further, by taking more than nine months to notify affected individuals, the Ministry and EDS breached their s. 30 obligations. The Ministry and EDS have since taken significant steps to improve security and to develop employee awareness of, and compliance with, privacy law.

Examples abound these days of privacy breaches involving the unauthorized disclosure or acquisition of personal information because of compromised storage, handling or disposal of computer devices or electronic data media. This is so even though security safeguards are available and even though governments and businesses know that they must protect the security, confidentiality and integrity of the personal information they hold. This case illustrates the all too common failure of both public and private sector organizations to ensure that safeguards are identified and diligently implemented throughout organizations.

This investigation report addresses a complaint made by the B.C. Nurses’ Union regarding a package of contracts between Telus and Vancouver Hospital and Health Sciences Centre (“Vancouver Hospital”). The complaint focused on concerns about whether the contracts, or procedures under them, comply with Vancouver Hospital’s obligations regarding the privacy of patients’ personal information under Part 3 of FIPPA.

This document deals with concerns raised about British Columbia universities' involvement in marketing products or services to students or alumni. It addresses these issues and includes recommendations to the Information and Privacy Commissioner for universities and other public bodies to improve their privacy protection practices where personal information is collected, used or disclosed for marketing purposes.

The Office of the Information and Privacy Commissioner (the Office) investigated the British Columbia College of Teachers’ disclosure of personal disciplinary information to verify that its policies and practices comply with section 33 of the Freedom of Information and Protection of Privacy Act (the Act).

In September 1996, the City of Victoria announced it was becoming the first municipality in Canada to provide property assessment information to the public through the Internet. The new service would allow the public to search the database by property owner's name, address and Roll number. The Office of the Information and Privacy Commissioner received a number of complaints from citizens concerned about their privacy. The Commissioner's report focuses on the privacy issues surrounding the publication of personal information in property databases. It examines the wider assessment system and most specifically, the BC Assessment Authority, which assumes the lead role in the property assessment system.

This Investigation Report is the result of the investigation of two privacy complaints against the Insurance Corporation of British Columbia (ICBC), one regarding the ICBC "Customer Appeal Program" survey, and one regarding the "Customer Satisfaction" survey, both conducted by Campbell Goodell Traynor of Vancouver. The two complainants objected to the disclosure of their personal information by ICBC to a contracted survey research company.

On September 28, 1995, in response to a complaint filed by a reporter for the Vancouver Sun, the Office of the Information and Privacy Commissioner (our Office) opened an investigation into alleged delays by the (former) Ministry of Social Services (the Ministry) in responding to requests for general information.

The Office of the Information and Privacy Commissioner anticipates that the publication of this report will lead to greater public awareness about the existence and uses of the Motor Vehicle Database. There are many user groups of the database and while most uses are legally authorized and necessary for the functioning of the motor vehicle registration and insurance system, a very real possibility exists for misuse of the personal information in the system.

On 29 March 1994, a complainant faxed a letter to the Office of the Information and Privacy Commissioner to complain that he had received information about his victim when he received his patient files from the Adult Forensic Psychiatric Out-Patient Services (the clinic) of the Forensic Psychiatric Services Commission (the Commission) of the Ministry of Health and the Ministry Responsible for Seniors (the Ministry). He requested an investigation by the Information and Privacy Commissioner to determine if this release of third party information was in violation of FIPPA.

The complainant, Jack Weisgerber, MLA, alleged that, in response to a routine request for records, the Ministry of Finance and Corporate Relations improperly disclosed personal information.