$93M class-action lawsuit filed against City of Calgary for privacy breach

Lawsuit alleges personal info of 3,700 city staffers sent to an employee of another Alberta municipality

Image | Calgary Municipal Building

Caption: Lawsuit claims thousands of city employees are now at a higher risk of identity theft, financial fraud, financial losses and psychological injury, including humiliation. (Monty Kruger/CBC)

The City of Calgary is being sued for $92.9 million, accused of breaching the privacy rights of more than 3,700 of its employees.
The class action lawsuit was filed Tuesday, alleging a privacy breach in June 2016. The court document claims a city staffer sent an email to an employee of another Alberta municipality, sharing the personal and confidential information of 3,716 municipal employees.
The personal information was contained in Workers' Compensation Board claim details and included medical records, Social Insurance Numbers, addresses, dates of birth, Alberta Health Care numbers and income details.
The statement of claim accuses the city of "acting with the most obvious neglect."
The lawsuit claims the thousands of city employees are now at a higher risk of identity theft, financial fraud, financial losses and psychological injury, including humiliation.
"We don't know whether the information was misused," said lawyer Patrick Higgerty, who represents the plaintiffs. "That creates a lot of anxiety."

City said info deleted

In August 2016, the city publicly apologized for what it called "human error" in releasing the WCB claim information on June 14 and 15, 2016.
The information had been collected between 2012 and 2016.
At the time, the city said an investigation revealed the disclosure happened when a city employee sought technical assistance from a contact working at another municipality.
The information was sent to the recipient's work and personal email addresses.
Officials believe the breach was not malicious in nature, the city's acting chief security officer, Donald Von Hollen, said at the time.
The information was not shared further and was deleted.
None of the allegations have been proven in court and a statement of defence has not yet been filed.