The NWT’s information and privacy commissioner says the territorial government needs more dedicated staff that are properly trained in handling sensitive information and responding to requests.
Presenting his first annual report to MLAs on Thursday, commissioner Andrew Fox said while the Department of Health and Social Services established mandatory privacy training for employees in 2017, lack of training keeps leading to privacy breaches.
Fox said he’s not aware of any overarching policy that ensures all NWT government employees are properly trained in privacy before they begin handling personal information.
“Mistakes are most often made by inexperienced employees doing jobs for which they have not been properly trained to do,” he said.
“Without more training or proper training, we have more mistakes. Without sufficient staff, you also have delays and people making mistakes for want of sufficient time to take due care and attention.”
Fox pointed to the discovery of health records at the Yellowknife dump during Stanton Territorial Hospital’s move to a new building and the abandonment of patient records in a washroom at the Fort Smith Health Centre, both in 2019. According to his annual report, there were 66 privacy breach notifications under the Health Information Act in 2020-2021.
Fox said public bodies are legally obliged to protect private information and provide access to public information, which he called “a valuable, essential quality to democracy.”
“The obligation to take those safeguards, if they’re not understood and they’re not implemented by people who are actually dealing with the stuff on the ground, it really doesn’t work.”
Fox said he has heard from access-to-information coordinators who are frustrated because they lack the training to do their jobs effectively.
He gave the example of one coordinator who received no proper training during four years in the role. After failing to respond appropriately to a request, they told Fox they weren’t aware they were allowed to ask for clarification from the applicant about the information sought.
“I don’t mean to belittle the person at all but it just indicates a serious lack of training,” Fox said, adding clarifications are a basic part of the process. “If the person doesn’t know that, they’re similarly poorly situated to make every reasonable effort to assist the applicant with an open, accurate, complete, prompt access to information response.”
Fox acknowledged challenges like the cost of training, demand on resources, and having to start from scratch when there is staff turnover.
Yet he said the mistakes that can result from a lack of adequate training also have costs, like the time and work it takes to investigate and resolve issues, and the consequent damage to public trust.
“If sensitive personal information is lost in a parking lot – or left unattended in a washroom, carelessly disposed of at the dump – there’s a distinct possibility that the public might grow hesitant to share sensitive personal information, even though there may be good reasons why a public body needs it,” he said.
While the territory has had information and privacy legislation since 1996, Fox said some public bodies still do not have adequate staff to meet their obligations under those laws. In some cases, he said, public bodies have no access-to-information coordinators at all.
“Departments that don’t have permanent funded positions in their staff suggests to me that, at some level, those positions are not viewed as part of the department’s core functions,” Fox said.
“Privacy protection, the ability to access records, are not add-ons. They’re an integral part of program service delivery.”
During his presentation, Fox did praise the territorial government’s recent creation of an access-to-privacy office.
He said he is encouraged that there are now full-time, trained employees in a centralized office responding to access-to-information requests.