Nova Scotians need better notification of privacy breaches, report says

Nova Scotia's privacy commissioner is calling for changes to make sure peopleare notified when their private information is compromised.

In her annual report, Catherine Tullycalled it "a significant shortcoming of our laws" and expressed concern NovaScotiansaren't hearing about privacy breaches.

"Breaches are happening everywhere, they're happening in business, they're happening at all levels of government all across the country and around the world," she said.

"It's the snooping by employees, it's the unauthorized sharing, the theft of personal information."

Plenty of breaches happening

Currently, the province isn'trequired to give notice to individuals when a government department has committed a privacy breach, but Tully said plenty of them are happening.

She looked at other jurisdictions where government privacy breaches are reported and studied their numbers.From there she was able to put together a per capita rough estimate for Nova Scotia.

"If breaches were reported here, based on population, then roughly there would be probably 10significant breaches in 2015 and up to as many as 154 breaches, just generally," she said.

Progressive Conservative Party Leader Jamie Baillie said he's not shocked by those numbers.

"It's not a surprise because it's a secret, and that's the problem," he said. "I think Nova Scotians, they expect their private information to be treated with respect."

Breach by premier's office

Tullynoted that for the first time ever, her office initiated an investigation this past yearinto a privacy breach by a government department, the premier's office.

It was in response to the premier's former chief of staff,KirbyMcVicar,revealing health information about Independent MLA Andrew Youngerto the media.

After the investigation,Tully'sreport made six recommendations, including appointing a chief privacy officer to "provide strategic privacy leadership" across government.

Tully said caseloads jumped 41 per cent in 2015-16, including a 17 per cent increase in reviews and complaints.

Last year, Tully said more needs to be done to educate people about the Freedom of Information and Protection of Privacy Act and speed up the process of getting information to applicants. This year, she said outreach was one of their major successes with a 569 per cent increase in consultation requests.

• A brief guide to Nova Scotia's freedom of information law

Tully said as a result of meeting with hundreds of government officials,she will be developing and offering training to public bodies on how to recognize a privacy breach and manage it properly.

"Many of them talk about the fact that they are concerned they don't have enough training to recognize a privacy breach and they don't know what to do when a breach happens," she said.

Backlog progress

Tully says her office has also been able to tame the backlog of requests.

Requests for information are supposed to be resolved within 30 days, but last year, the average wait time to close a file that hadbeen sent to her office for review was two years.

In Tuesday's report, she said once files were assigned, staff resolved matters, on average, within 65 days.

Tully admits heroffice is strapped for cash and at times understaffed, but Baillie said more money isn't necessarily the solution.

"We have to get to the root of why so many Nova Scotians resort to formal freedom of information requests," he said.

"If the government wasn't so secretive in the first place, you might actually see a reduction in that backlog through greater transparency to begin with."

The system is improving

But Justice Minister Diana Whalen said recent efforts by the government are already benefiting the system.

The government has consolidated most of the people who deal with information and privacy requests in one area and offered themenhanced training.

"I see us getting better and better because of the centralization of our service and the standardization of all of our policies and procedures."

The minister said people are already notified of breaches if it has an impact on them and she isn't sure if Tully's office needs to be made aware in each of those cases. While Tully said increased demands for her office's services are creating a strain on resources, Whalen said there would be no increased allocation.