The privacy commissioner has found a government department not only committed a privacy breach, but that it failed to follow a subsequent directive from the commissioner.
Donovan Molloy says the Department of Transportation and Works relocated a number of paper records to its depot in Grand Falls-Windsor. The records, containing sensitive personal information, were stored in an unsecured area accessible to all employees and members of the public.
An employee at the depot notified the department that some boxes were unsealed and that personal information—including social insurance numbers—could be viewed by anyone with access to the area. Despite the notification, 19 days expired before the records were transferred to a secure area.
The Department then declined to follow a directive from Molloy that those impacted by the privacy breach be notified. Molloy says their response generally constituted a disregard of its responsibilities.