Privacy commissioner again calls for more staff and training

The NWT’s information and privacy commissioner says the territorial government lacks adequate staff to meet the demand for access to information.

Andrew Fox called for more dedicated information and privacy staff in his latest annual report, which covers the period from April 1, 2023 to March 31, 2024.

He noted that his office has seen an uptick in complaints about the territorial government failing to respond to access to information requests within mandated timelines. In some cases, he said, responses were months overdue.

“It is difficult to understand why the Legislative Assembly created legal obligations for public bodies without ensuring public bodies had the capacity to discharge those obligations,” Fox wrote, referring to deadlines in the NWT’s Access to Information and Protection of Privacy Act, which was updated in 2021.

“This is an ongoing source of concern for my office and frustration for members of the public who seek access to government records on a timely basis”

Fox added it is “fundamental” for “public bodies to organize themselves to comply with the law.”

In 2022, Fox said requests received late responses more than half the time.

“I don’t think the needle has moved much since then and that, I think it’d be fair to say, is not a satisfactory service standard,” he recently told Cabin Radio.

Staffing has not increased

The NWT government’s access and privacy office (which is different than Fox’s oversight office) was created as a one-window service point for the public to submit access to information requests and receive responses.

However, Fox said the NWT government office’s resources have not increased since it was formed, “though the need is demonstrable.”

While the territorial government approved two positions for the office in its 2024-25 budget, he said those positions are not new and just continue existing staffing.

“The access to privacy office is not well resourced to process the number of access requests that it gets,” Fox said. “This is not a new situation and, you know, I think it has been a problem almost from its inception.”

Fox noted that staffing those positions can be challenging because they require skills and training that are “not necessarily easy to find, and they don’t necessarily come cheap.”

Fox said he is encouraged by the mandate letter for the justice minister, where RJ Simpson – who, as premier and justice minister, was both the letter’s author and recipient – committed to respond to access to information requests “in a timely manner.”

The privacy commissioner said he was concerned, however, by comments Simpson has made in the assembly about the possibility of reviewing the timelines by which public bodies are required to respond to requests.

“In my view, lowering the requirements of public bodies is not the best way forward,” Fox wrote.

“Adjusting the response times without providing more resources to complete the work will not address the problem; it could only provide a temporary reprieve.”

Drop in privacy breaches

On the privacy side, Fox said there had been “significant improvement” in the number of privacy breaches, which dropped from 105 in the previous annual report to 66.

He said the Covid-19 pandemic had undoubtedly contributed to a surge in privacy breaches between 2021 and 2023, making it difficult to predict the long-term trend.

For example, Fox said this fiscal year has already resulted in 85 reported privacy breaches by the halfway point.

Fox said privacy breaches continued to occur last year by fax, email, when printing documents, and when using electronic health information systems.

He highlighted the importance of training for staff who handle private information such as medical records.

That training “is essential to creating a privacy-protective workplace culture, helping to avoid incidents that proceed from momentary inattention when handling personal health information,” Fox wrote.

“Employees working with personal health information need to keep privacy top of mind, and this requires express support from management and regular reinforcement through training.”

The Department of Health and Social Services created a mandatory training policy in 2017, mandating annual privacy training for all department and health authority staff. Yet review reports published by Fox indicate that not all employees have completed training.

According to the Department of Finance, the NWT government provides an access to information and privacy training course to increase employees’ understanding of their obligations, show them how to safeguard information, and ensure they are informed of individuals’ rights to access information.

The department said training is required for only some territorial employees, but encouraged for all employees.

Commissioner can’t enforce recommendations

Fox has previously called for the territorial government to hire more dedicated staff and provide more training to meet its information and privacy obligations.

However, there is no legal requirement for the territorial government to accept Fox’s recommendations. His office has little power to enforce them.

“Ultimately, these policies and any recommendations that we make are geared towards protecting people’s personal health information from being disclosed, used or collected without authorization,” Fox said.

Fox is scheduled to give a public presentation on his latest annual report to a committee of regular MLAs on Thursday.