B.C. minister, victim assistance sued over alleged privacy breach

WARNING: This story contains details of sexual abuse and ​​​intimate partner violence.

A woman is suing the B.C. government and the head of the provincial victim assistance program, claiming they failed to protect sensitive files detailing alleged physical and sexual abuse she suffered at the hands of her husband.

The woman filed a notice of civil claim in B.C. Supreme Court in New Westminster against Crime Victim Assistance Program (CVAP) director Grant McKellar and B.C. Public Safety Minister Mike Farnworth, though the lawsuit also applies to anyone else who holds that position.

The woman, who is only identified as Jane Doe in the lawsuit, alleges she suffered "humiliation, trauma," "collapse of trust in the government," and "fear of physical harm of death" from her husband after a CVAP employee allegedly accessed her file without authorization in August 2022.

She told CBC News that she felt she "was not a person with rights and dignity that anyone was required to respect." It's why she says she decided to take legal action.

"Reporting caused me significant harm and left me vulnerable to further victimization," she said.

The lawsuit alleges the minister and CVAP director violated their obligations under the Freedom of Information and Protection and Privacy Act, "were vicariously liable for the actions" of the employees and "owed a duty of care" to the woman to safeguard her private information.

None of the allegations have been proven in court. No statements of defence have yet been filed.

CBC News requested interviews with Farnworth and McKellar, but they were not made available. The Ministry of Public Safety, which is in charge of CVAP, declined to answer written questions, citing the ongoing legal proceedings. 

Years of alleged abuse

In March 2022, Jane Doe told Surrey RCMP that her husband had allegedly physically and sexually abused her over several years, according to the lawsuit. 

She went to police because she feared her husband would retaliate against her for restarting claims in family court, the lawsuit said. She had fled their home a year prior and was trying to terminate her husband's parental rights. Two of her children also made police statements. 

Jane Doe additionally made a video police statement that was transcribed detailing a 2013 incident where her husband, who is not named in the lawsuit, allegedly "sexually assaulted Jane Doe for several hours, and repeatedly hit in her head, which caused her to lose consciousness," according to the lawsuit.

Shortly after, Jane Doe applied to get benefits for counselling with CVAP for her and her children. CVAP provides financial supports to victims of violent crime.

In November, CVAP's director told her in a virtual meeting that the applications had been the subject of a privacy breach that occurred in August, according to the lawsuit.

File accessed out of 'curiosity' 

The lawsuit said one or more employees accessed her and her children's files, including police statements, without authorization.

The woman said in the lawsuit that a close relative of her husband works at CVAP.

Jane Doe doesn't know the extent to which her personal information has been used, the lawsuit said.

In an email obtained by CBC News, McKellar told the woman that her "personal information was inappropriately accessed by a government employee" and apologized to her. 

Another letter by the Ministry of Public Safety, obtained by the woman through an access to information request, said the employee appeared motivated by "curiosity" to access her file.

The employee's identity and any sanctions that they may have faced could not be disclosed due to privacy concerns, the letter said.

Ministry 'did not fully protect' info: privacy watchdog

The woman filed a complaint with B.C.'s privacy watchdog, which found that her information was used inappropriately and that the Public Safety Ministry "did not fully protect" it.

An investigator with the Office of the Information and Privacy Commissioner found it particularly concerning that the woman was notified about the privacy breach 78 days after it happened.

"Notification cannot erase a privacy incident but, if done expeditiously, it is often an important tool for mitigating the harm caused by that incident," wrote the investigator in a decision obtained by CBC News.

"This delay constituted a failure to protect your personal information.

The investigator said he's satisfied that the ministry has taken adequate measures to "mitigate the harm caused by this incident" and prevent it from happening again.

The ministry launched an internal investigation after the privacy breach, according to the investigator. It also locked down access to the woman's file so that it doesn't turn up in searches and has committed to providing more training for staff, the investigator said.

Lawsuit alleges litany of failures 

The lawsuit claims the public safety minister and CVAP director failed to establish and implement appropriate measures to protect people's sensitive information.

"They failed to exercise the standard of care required of a reasonable and careful public body," the lawsuit said, noting that Jane Doe feels her and her children's safety is at risk and is scared to provide any further information to public authorities.

She's seeking aggravated, general and punitive damages.

"I want to assert my rights and, in so doing, claim back some of my personhood and sense of dignity," she told CBC News.

For anyone affected by family or intimate partner violence, there is support available through crisis lines and local support services. ​​If you're in immediate danger or fear for your safety or that of others around you, please call 911.