Privacy breaches can take many forms—from someone mistakenly sending an email containing sensitive personal information to the wrong person, to a hacker stealing and exploiting someone’s information for profit. All privacy breaches involve either the theft or loss of an individual’s personal information; or a collection, use, or disclosure of that information that contravenes the privacy laws that govern public bodies in BC – e.g. the Freedom of Information and Protection of Privacy Act (FIPPA).

A privacy breach can cause significant harm, including:

• Identity theft;
• Risk of physical harm;
• Humiliation;
• Damage to personal or professional reputation; and/or
• Loss of business or employment opportunities. 

For these reasons, the City follows an in-depth Privacy Management Program as required under FIPPA. The City conducts mandatory privacy awareness training annually for all staff. Elected officials also receive training on their privacy obligations under FIPPA. 
 

In addition to their obligations under FIPPA, elected officials also have a duty to maintain confidentiality under section 117 of the Community Charter. This duty extends to all confidential City records and information, including information considered in closed council meetings. If an elected official improperly discloses confidential information, this may be a breach of their obligations under the Community Charter. In certain circumstances, if the City suffers damage as a result of that breach, the City may recover its damages from the elected official responsible for the breach. 

City records may be confidential and/or contain personal information. As a result, the improper disclosure of City records may constitute a breach of confidentiality, a privacy breach, or both.

When a privacy breach occurs, the breach must be immediately reported to the City’s Privacy Officer. The Privacy Officer investigates whether a breach has occurred, takes steps to contain the breach, and works to mitigate any harm that may result.

If a privacy breach could result in significant harm to the affected individual(s), the City is required by legislation to notify the BC Office of the Information and Privacy Commission (OIPC) and affected individual(s). Upon being notified of a privacy breach, the OIPC will monitor the breach, suggest further mitigation efforts, and confirm legislative requirements have been met. The OIPC has the ability to initiate investigations and audits of public bodies; however, under current legislation, it does not have the authority to investigate individual elected officials.  

Elected officials have a statutory duty to comply with privacy legislation. Elected officials must protect personal information in the City’s custody or under its control, and can only collect, use, or disclose personal information in accordance with the requirements and restrictions set out in FIPPA. 

If an elected official fails to protect personal information as required by FIPPA, they can be prosecuted.

For example, in May 2011, a Prince George City Council Member was found guilty of breaching section 30.4 of FIPPA (R. v. Skakun, 2011 BCPC 98). The Council Member was found to have improperly disclosed a confidential and privileged workplace harassment report to the media. The Council Member obtained the report during a closed council meeting. The Court found that the council member was not authorized to release the sensitive personal information contained in the Report—he was therefore guilty of contravening the provisions of FIPPA.