Investigation and Audit Reports

June 2020 report, published on November 25, 2024. On November 1 and 5, 2019, respectively, LifeLabs notified the Office of the Information and Privacy Commissioner of Ontario (ON IPC) and the Office of the Information and Privacy Commissioner for British Columbia (BC OIPC) of a potential privacy breach under Ontario’s Personal Health Information Protection Act (PHIPA) and British Columbia’s Personal Information Protection Act (PIPA). LifeLabs advised that on October 28, 2019, through a security assessment conducted by a third party, it had detected a cyberattack on its computer systems. After locking down the affected systems, LifeLabs was contacted by the attackers. The attackers claimed to have stolen the personal information and personal health information of LifeLabs’ customers and threatened to release the information publicly unless LifeLabs paid a ransom. The attackers also threatened to include a report detailing the exploits of their attack in the information released publicly, and provided LifeLabs with a sample of the personal information and personal health information they had stolen.

The Office of the Information and Privacy Commissioner (OIPC) conducted this audit of the Vancouver Coastal Health Authority’s (VCH) Freedom of Information (FOI) program under s. 42(1)(a) of FIPPA. Similar to previous OIPC audits of public bodies’ access to information processes, this audit focused on whether VCH met its duty to assist and examined areas where VCH performed well, and areas where it required improvement to comply with legislation and OIPC guidelines.

As digital innovation continues to transform health care provided in Canada and abroad, British Columbians find increasing amounts of their sensitive personal information being collected and stored within digital systems. From personal health numbers to records relating to individuals’ mental health status, British Columbia’s Provincial Public Health Information System stores large amounts of sensitive information about those of us accessing healthcare and communicable disease services.

The Office of the Information and Privacy Commissioner for British Columbia (OIPC) investigated the use of facial recognition technology (FRT) by four Canadian Tire stores (the stores) located in British Columbia.

The Provincial Public Health Information System, or the System, as it is referred to in this report, contains personal information about almost all of us – from personal health numbers to immunization records. If you have received medical care in BC for a pregnancy, a mental health issue, or for a sexually transmitted infection, you will find that sensitive personal information recorded in the System. And every day, hundreds of healthcare workers and policymakers across BC access this System, as they must.

Joint Investigation by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta, and the Office of the Information and Privacy Commissioner for British Columbia into The TDL Group Corp.’s (the operator and franchisor of Tim Hortons in Canada) compliance with Canada’s Personal Information Protection and Electronic Documents Act, Quebec’s Act respecting the Protection of Personal Information, Alberta’s Personal Information Protection Act, and British Columbia’s Personal Information Protection Act.

Private sector liquor and cannabis retailers are tasked with collecting our personal information. And for good reason. They need to verify age by checking a driver’s license, they capture video using surveillance systems to ensure security, they use our financial information for payment, and they collect employee information for HR and payroll purposes. Retailers’ authority to collect this kind of information is found in BC’s Personal Information Protection Act (PIPA).

Joint investigation of Clearview AI, Inc. by the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, the Information and Privacy Commissioner for British Columbia, and the Information Privacy Commissioner of Alberta

Government’s information is the public’s information. More than a glib phrase, this principle was unanimously enshrined by BC’s legislature in the Freedom of Information and Protection of Privacy Act (FIPPA) more than 25 years ago. FIPPA gives each of us the right of access to a public body’s information within a prescribed time frame, subject to carefully prescribed exceptions.

Joint Investigation by the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Privacy Commissioner of Canada into AggregateIQ Data Services Ltd.’s (“AIQ”) compliance with the Personal Information Protection Act (“PIPA”) and the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in respect of certain collections, uses, and disclosures of personal information on behalf of other organizations in order to provide targeted advertising, data processing, and database management services in political campaigns. Specifically, this report focuses on whether AIQ met its legal obligations relating to consent and safeguarding of personal information.

Joint Investigation by the Office of the Privacy Commissioner of Canada and the Office of the Information and Privacy Commissioner for British Columbia into Facebook, Inc.’s compliance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and the Personal Information Protection Act (British Columbia) (“PIPA”)

The duty to assist citizens with requests to access records is an essential component of BC’s Freedom of Information and Protection of Privacy Act (FIPPA). It is important that public bodies embrace this responsibility by responding openly, accurately and completely, and without delay to all requests.

WorkSafeBC collects highly sensitive personal information in many ways, including through employee insurance claims, reports of unsafe working conditions, or during an incident investigation. In the case of workplace injuries that require medical attention, the incident must be reported to WorkSafeBC. Employees cannot opt out and so must trust the agency to appropriately handle their personal information.

The Freedom of Information and Protection of Privacy Act (FIPPA) came into force in 1993 to make public bodies more accountable to the public and to protect personal privacy. My mandate is to enforce compliance with FIPPA and one way I accomplish this is by reporting on government’s performance in responding to access to information requests. This report examines in detail the performance of all ministries and compares and analyzes the results.

This is the first audit of a private sector business to determine the organization's compliance with PIPA.

This investigation report was issued in response to a complaint from the University of Victoria‘s Environmental Law Centre (ELC). The complaint alleged that the Ministry of Environment had failed to meet its obligation under the Freedom of Information and Protection of Privacy Act (FIPPA) in relation to access to information requests made by the ELC, and that the Ministry had failed to disclose information in the public interest, as required by FIPPA.

This report details the circumstances surrounding the loss of a portable hard drive by the Ministry of Education containing the personal information of 3.4 million BC and Yukon students and teachers.

Access to information rights can only exist when public bodies create the conditions for those rights to be exercised. Government must promote a culture of access, from executive leadership to front-line employees. If they fail to meet this obligation, the access to information process is rendered ineffective.

The Mount Polley mine tailings pond dam failure on August 4, 2014, was a serious environmental disaster. In the wake of the tailings pond breach, government initiated three separate investigations to determine what went wrong, including an Independent Expert Engineering Investigation and Review Panel, whose final report on the mine tailings pond breach was published on January 30, 2015.

This report examines the degree to which the BC government is fulfilling its duty to respond to, and properly manage, its privacy breaches.

Archiving is a public good. Records about key actions and decisions of government must be preserved in a lasting historical record for future generations. Without a comprehensive public archive, access to information and the ‘right to know’ is significantly and severely impaired.

This report examines the increasing use of employment-related record checks, specifically what are known as police information checks.

Section 25 of the Freedom of Information and Protection of Privacy Act (“FIPPA”) contains two grounds upon which public bodies are obligated to provide the public with timely information. One is where there is a significant risk of harm to the environment or to health or safety of the public and the other is where this information is, for any other reason, clearly in the public interest. These provisions override every other provision of FIPPA.

This report evaluates the Government of British Columbia’s open government initiative and whether it promotes transparency and accountability in practice. I make eighteen recommendations to strengthen BC’s open government initiative and ensure its sustainability over the long term.

This report investigates the growth of “no responsive records” replies by the Government of British Columbia in response to the general access to information requests of citizens. It also reports on five specific instances of “no responsive records” replies to requests made to government relating to the September 2012 resignation of the Premier’s Chief of Staff.

The purpose of this paper is to serve as a record of the roundtable discussion on access to data for health research and to identify next steps.

On January 9, 2012 the University of Victoria notified the OIPC of a break-in that had occurred on campus. Among the items stolen was a USB key containing the personal information of current and former UVic employees. The Commissioner initiated an investigation in order to determine whether the University met its obligation to protect personal information as per section 30 of FIPPA.

This report is a six-month review of the strategies and outcomes of government’s efforts to improve response times to media and political party applicants, following-up the Timeliness Report issued in August 2010.

This is the second report on the performance of ministries in meeting their obligation under the Freedom of Information and Protection of Privacy Act (“FIPPA”) to respond to access requests without delay.

On April 7, 2009 an employee of the Ministry of Children and Family Development (“MCFD”) was arrested by the RCMP on suspicion of fraudulently obtaining identification. During the course of the search of the employee’s home, RCMP officers discovered that the employee had over 400 pages of government documents containing sensitive personal information about more than 1,400 clients of the Ministry of Housing and Social Development and MCFD. This report results from the OIPC’s investigation into the government’s response to the police discovery of sensitive personal information.

This report aims to shine light on problems within the provincial government in meeting the legal obligations imposed by the Freedom of Information and Protection of Privacy Act to respond to access requests in a timely fashion.

Four computer tapes containing personal information of residents of British Columbia and New Brunswick who received medical services outside their home province was couriered from New Brunswick to Health Insurance BC, a contractor for the Ministry of Health in British Columbia. They never arrived at HIBC. The information was on magnetic tapes and was not protected by encryption. This method of transferring personal information did not meet the security measures required under s. 30 of the Freedom of Information and Protection of Privacy Act. The Ministry’s policies and practices resulted in failure to ensure the tape loss was detected in a timely way. The Ministry also failed to notify affected individuals and the OIPC in a timely way. After the loss was discovered, the Ministry took appropriate action to mitigate risk to the affected individuals. After the incident, the Ministry ceased exchanging unencrypted personal information of this kind with other jurisdictions. New Ministry procedures now monitor more closely such exchanges of personal information and the Ministry continues to work towards an even more secure method of data transfer.

An employee of EDS, a Ministry service provider, was caught improperly browsing through a Ministry computer system for personal information of friends and acquaintances. This had gone undetected because of insufficient technical security measures. The inadequate security measures constituted a breach of s. 30 of FIPPA. Further, by taking more than nine months to notify affected individuals, the Ministry and EDS breached their s. 30 obligations. The Ministry and EDS have since taken significant steps to improve security and to develop employee awareness of, and compliance with, privacy law.

The Employee and Family Assistance Program (“EFAP”) is a confidential employee-counselling service operated as a component of the Vancouver Coastal Health Authority (“VCHA”). It is staffed by VCHA employees and is responsible to VCHA. EFAP is a program of the VCHA and is not a separate entity. As a health authority established under the Health Authorities Act, VCHA is a “health care body” and therefore a “public body” covered by the Freedom of Information and Protection of Privacy Act (“FIPPA”). EFAP’s actions are therefore those of the VCHA for FIPPA purposes.

This investigation report addresses a complaint made by the B.C. Nurses’ Union regarding a package of contracts between Telus and Vancouver Hospital and Health Sciences Centre (“Vancouver Hospital”). The complaint focused on concerns about whether the contracts, or procedures under them, comply with Vancouver Hospital’s obligations regarding the privacy of patients’ personal information under Part 3 of FIPPA.

This document deals with concerns raised about British Columbia universities' involvement in marketing products or services to students or alumni. It addresses these issues and includes recommendations to the Information and Privacy Commissioner for universities and other public bodies to improve their privacy protection practices where personal information is collected, used or disclosed for marketing purposes.

The Office of the Information and Privacy Commissioner (the Office) investigated the British Columbia College of Teachers’ disclosure of personal disciplinary information to verify that its policies and practices comply with section 33 of the Freedom of Information and Protection of Privacy Act (the Act).

In September 1996, the City of Victoria announced it was becoming the first municipality in Canada to provide property assessment information to the public through the Internet. The new service would allow the public to search the database by property owner's name, address and Roll number. The Office of the Information and Privacy Commissioner received a number of complaints from citizens concerned about their privacy. The Commissioner's report focuses on the privacy issues surrounding the publication of personal information in property databases. It examines the wider assessment system and most specifically, the BC Assessment Authority, which assumes the lead role in the property assessment system.

This Investigation Report is the result of the investigation of two privacy complaints against the Insurance Corporation of British Columbia (ICBC), one regarding the ICBC "Customer Appeal Program" survey, and one regarding the "Customer Satisfaction" survey, both conducted by Campbell Goodell Traynor of Vancouver. The two complainants objected to the disclosure of their personal information by ICBC to a contracted survey research company.

On September 28, 1995, in response to a complaint filed by a reporter for the Vancouver Sun, the Office of the Information and Privacy Commissioner (our Office) opened an investigation into alleged delays by the (former) Ministry of Social Services (the Ministry) in responding to requests for general information.

The Office of the Information and Privacy Commissioner anticipates that the publication of this report will lead to greater public awareness about the existence and uses of the Motor Vehicle Database. There are many user groups of the database and while most uses are legally authorized and necessary for the functioning of the motor vehicle registration and insurance system, a very real possibility exists for misuse of the personal information in the system.

On 29 March 1994, a complainant faxed a letter to the Office of the Information and Privacy Commissioner to complain that he had received information about his victim when he received his patient files from the Adult Forensic Psychiatric Out-Patient Services (the clinic) of the Forensic Psychiatric Services Commission (the Commission) of the Ministry of Health and the Ministry Responsible for Seniors (the Ministry). He requested an investigation by the Information and Privacy Commissioner to determine if this release of third party information was in violation of FIPPA.

The complainant, Jack Weisgerber, MLA, alleged that, in response to a routine request for records, the Ministry of Finance and Corporate Relations improperly disclosed personal information.