ST. JOHN'S, N.L. — The province’s privacy commissioner is urging the RNC to take a closer look at its privacy practices as a result of a breach that happened last year when an officer accessed and shared another officer’s personal and medical information.
In a report released Wednesday, Information and Privacy Commissioner Victoria Woodworth-Lynas concluded the RNC didn’t properly protect the officer’s private information when another officer entered an unoccupied manager’s office and retrieved a form that contained personal details about the first officer.
The officer who was the victim of the breach filed a complaint to the RNC in July 2018 when another employee told her it was being discussed within the division where she worked.
The RNC conducted an internal investigation, during which an officer admitted she had accessed and disclosed the other female officer’s personal information contained on the form. This form had been located in the manager’s office, which was unlocked and which she entered when the manager was not there that day.
The RNC determined the officer breached a number of provisions of the RNC’s Confidentiality Policy and Procedure manual and was charged with two counts of conduct unbecoming a police officer for reading and disclosing the private information of the complainant without consent and without the legal authority to do so.
She pleaded guilty to two counts of conduct unbecoming a police officer, including failing to obey RNC regulations respecting policy and procedures.
In February 2019, Chief Joe Boland imposed a sanction — that the officer apologize to the officer whose privacy she breached.
The commission became involved after the officer whose information was accessed filed a privacy complaint in December 2018, “as she had not received any update from the RNC regarding its internal investigation status since September 2018,” according to the report.
“She also felt that the investigation had become less of priority for the RNC as she was no longer an employee there.
“As informal resolution was unsuccessful, a formal investigation proceeded.”
The officer has resigned from the RNC for another opportunity, but told the commission that her decision to resign “was a direct result of the uncomfortable, unsupportive, shaming and hostile work environment that she experienced since the breach of her privacy.”
She told the commission she would like to see transparency and accountability within the RNC.
“She feels that this privacy breach and the subsequent poor treatment she was subjected to are indicative of the workplace culture within the RNC and how accommodations are handled and viewed. (She) feels that individuals at the RNC will continually be afraid to seek accommodations or help if the result is a breach of privacy and poor treatment.
“(She) felt the breach was malicious and that this type of a breach is representative of a systemic issue relating to the workplace culture within the RNC. She feels that the attitude of many officers is that they are entitled to know information because of who they are.”
The commissioner said that during the investigation the RNC “provided very general statements” when asked specific questions about how it dealt with the breach.
The report pointed to concerns about the time it took for the officer to find out about the breach — a number of weeks.
Also, while the breach was reported in July 2018, the RNC did not send the breach notification form to the Office of the Information and Privacy Commissioner until Jan. 10, 2019.
“Six months is far too long,” Woodworth-Lynas said.
She also expressed concerns about the lack of security of the manager’s office.
“I have serious concerns regarding the lapse in physical security practices in this case,” said Woodworth-Lynas, who added employees should lock their offices when not in use as well as desks and cabinet drawers. “I strongly recommend further and targeted communication with all employees on this issue.”
The commissioner also recommended the RNC provide Access to Information and Protection of Privacy Act training to the officer’s specific division and that the RNC communicate to all employees the rules regarding the protection of and access to personal information.
“Without education, training and an environment that respects personal information, more breaches can be expected and RNC leadership will be held accountable,” the report states.
The RNC has 10 days to respond to the report.
Boland was out of the province Wednesday and unavailable for comment.
Twitter: @TelyRosie
