Lack of staff, training leading to privacy breaches, says N.W.T. information and privacy commissioner

Government departments' failure to provide adequate training and staff for the collection and disclosure of public — and personal — information is leading to mistakes and could erode people's confidence in their government, says the Northwest Territories information and privacy commissioner. 

"Government has to facilitate the access to information and protect the privacy interests of everyone, every one of us," Andrew Fox said Thursday at a public meeting related to the territory's Access to Information and Protection of Privacy (ATIPP) Act and the Health Information Act. 

"One of the key parts of having these acts work is to ensure that the people who are making it happen are sufficient in number and are trained to a level of competence. Without that, it doesn't work."

Fox told a committee of MLAs that the purpose of the two acts is to make the government accountable and to protect residents' privacy — "a valuable, essential quality to democracy."

But, he said, when some departments don't employ and properly train enough people on how to handle information held by the government, it suggests that these departments don't view access to information, or the protection of people's privacy, as among their "core" functions.

'Chronic problem'

Fox said several departments have seen significant staff turnover, and he cautioned that mistakes are most often made by inexperienced employees who haven't been properly trained.

He acknowledged that privacy training is available, but said he wasn't aware of a government-wide policy that ensures employees are properly trained before they begin collecting, using and disclosing personal information. 

He said sometimes this lack of training is a "chronic problem," and sometimes it leads to delays in people getting the information they asked for, or to privacy breaches.

"Mistakes can have a way of detracting from the public's faith in their government," he said.

"If sensitive personal information is lost in a parking lot, or left unattended in a washroom, or carelessly disposed of at the dump, there's a distinct possibility that the public might grow hesitant to share sensitive personal information, even though there may be good reasons why a public body needs it," said Fox. 

Kam Lake MLA Caitlin Cleveland agreed that mistakes often "come down to really tragic human error, or somebody not realizing in their job how an action has a trickle down effect or has an impact on information privacy." 

"And that does come back to training," he said.

Departments must help people get information

Fox also said that government departments and agencies must make all reasonable efforts to help people with their requests for information, but sometimes they fail to do so.

He called out the Northwest Territories Health and Social Services Authority and the Health and Social Services Department, specifically, for "some remarkable delays."

Fox noted one case in which an applicant asked the N.W.T. health authority for a large amount of information. The health authority asked for thousands of dollars as a deposit for accessing the information, and still took eight to 10 months to respond to the applicant.  

Fox attributed this "pretty egregious example" to insufficient staffing and "some managerial decision, or approach," that considers such requests to be a lower priority. 

Representatives from government departments and agencies didn't speak at the meeting, but in an email, a Health and Social Services Department spokesperson wrote that his department takes the "protection of privacy of N.W.T. residents seriously." 

He added that they "promote a culture of privacy" and follow "the established mandatory training policy, where we regularly provide training to all health and social services system employees." 

COVID-19 not an excuse

Fox recognized that COVID-19 intrudes on the work of government, but said departments can't continue to lean on the pandemic as an excuse for failing to respond to information requests in a timely manner. 

In fact, he pointed out, the ATIPP and health information acts were expressly excluded from an act passed in June of 2020 that allows for the temporary adjustment of some legislated dates and deadlines because of the burden created by COVID-19. 

In his annual report, Fox says that the new Access and Privacy Office in the Justice Department has centralized some access-to-information functions, which could improve the timeliness and quality of responses to requests for government records.  

At Thursday's meeting, Fox urged "all public bodies and health information custodians to ensure that new employees are given the appropriate training early on, both in the protection of privacy, and access to information, and that all employees should be given regular refresher of that."