Nova Scotia Privacy Review officer reviews workers' comp board

Until recently, the "Review Officer" appointed under Nova Scotia's Freedom of Information and Protection of Privacy Act only had the power to deal with access to information issues and not privacy complaints. That's now changed and the Protection of Privacy Review Officer, Dulcie McCallum has come out swinging following a review of the province's Workers' Compensation Board. Below is the press release, summarizing Review P-11-01 (PDF):

REVIEW OFFICER ISSUES PUBLIC REPORT: RECOMMENDS CHANGES TO WCB PRIVACY PRACTICES

November 18, 2011

Dulcie McCallum, Nova Scotia’s Privacy Review Officer, today released her report investigating the privacy practices of the Nova Scotia Workers’ Compensation Board: Privacy Matters: Creating a Zero Tolerance Privacy Environment. Ms. McCallum made 21 recommendations that she believes will improve the privacy culture at the WCB, and the WCB has agreed to implement all of the recommendations.

“Because privacy is such an important part of how we define ourselves, I have recommended that the WCB work towards creating an institutional goal where privacy is given priority, where one privacy breach is one too many,” said Ms. McCallum. “I believe this approach to privacy lines up closely to WCB’s primary emphasis on safety in the workplace, where one accident is one too many.”

The Review marks the first time the Privacy Review Officer has completed a systemic privacy review of a public body. Ms. McCallum launched the investigation early this year when it was publicly reported that at least two separate individuals had received another WCB claimant’s claim file when requesting their own. Most claimant's files include considerable personal information and in particular personal health information.

Before this report was made public, the Review Officer shared a draft version with the WCB in order to ensure that the Review Office had fully captured the work of the WCB and its privacy practices. In its response, the WCB emphasized the similarities between efforts to prevent workplace injuries and efforts to prevent privacy breaches and agreed to implement all 21 recommendations.

“I am happy to report that the WCB has fully accepted preventing privacy breaches as a priority and has indicated that our expert advice as to how to go about achieving that is welcome,” said Ms. McCallum. “I want to thank the WCB for the full cooperation it provided throughout this investigation.”

The WCB has committed to implementing seven of the recommendations immediately, while the remaining 14 will require a reasonable period of time to fully adopt. The Review Office intends to revisit the progress being made by the WCB on implementation within the next year.

The Privacy Review was expedited to ensure any privacy breaches that may have occurred were not ongoing and had been sufficiently contained by the WCB. The Privacy Review Officer found that they had been contained, though the overall privacy practices of the WCB needed improvement in order to give privacy protection the attention it deserved.