Key lessons for public servants from the 2017-18 Annual Report

September 27, 2018

Office of the Privacy Commissioner of Canada Privacy Alerts are intended to offer lessons learned, best practices and other important privacy news, trends and information related to privacy protection in the federal public sector. We encourage you to share this information with colleagues.

Our Annual Report tabled today highlighted a number of issues that all federal institutions should take note of.

Issue 1:

In one case, the Correctional Service of Canada had overwritten video recordings that purportedly contained evidence of an inmate being assaulted and harassed by correctional officers. While the inmate sought access to the recordings before they were overwritten, the institution made no effort to retrieve and assess the content during the short retention period, contrary to the Privacy Act.

Lesson learned:

• If your institution collects audio/video recordings and retains them for only short periods of time, have measures in place to retrieve and preserve the footage immediately upon receipt of a request for access under the Act.

Issue 2:

We launched a government-wide review of privacy breaches after noticing a drop in privacy breach reports to our office. Our review found that thousands of breaches occur annually and that some material breaches go unreported. More importantly, we found serious gaps in the way organizations recognize and manage privacy breaches.

Lessons learned:

• Federal institutions subject to the Privacy Act are required to notify the OPC and the Treasury Board of Canada Secretariat of all material privacy breaches.
• The Treasury Board Guidelines for Privacy Breaches state a breach is deemed “material” if the breach:
  • Involves sensitive personal information; and
  • Could reasonably be expected to cause serious injury or harm to the individual and/or involves a large number of affected individuals.
• Stay tuned! The OPC and TBS have committed to developing a new Privacy Act Breach Reporting Form to facilitate reporting, assist institutions with the management of breaches and bring greater clarity to the process.

Issue 3:

The Privy Council Office consulted us on a video campaign encouraging youth to submit videos in which they share their thoughts on the themes and priorities they would like to see reflected in government policy.

Lessons learned:

• Video campaigns that involve submissions from the public can help energize discussions around policy issues and motivate participation in the democratic process. However, it’s important to ensure consent is obtained from all participants, including third parties who may appear in the videos, before the videos are uploaded to a government website.
• Obtain written consent from all individuals appearing in videos – especially when minors are involved.

Want to know more?

You can contact us through our website to report a privacy breach at your institution or via email at notification@priv.gc.ca. You can also find information on what to expect during a complaint investigation on our website.