Nunavut’s information and privacy commissioner suspects there is significant under-reporting of privacy breaches in Nunavut.
“I think it more likely … that there are many privacy breaches that should be reported … but are not,” wrote commissioner Graham Steele in his office’s 2020-21 annual report.
Elaine Keenan Bengts, Nunavut’s previous information and privacy commissioner, who retired in January 2021, made similar observations.
The current and former privacy commissioners cite the November 2019 and the February 2021 ransomware attacks on Government of Nunavut (GN) and private sector Dept. of Education servers as the reasons why they expected an uptick in people’s privacy being breached.
The majority of privacy breach reports come from the Department of Health, which “takes privacy breaches very seriously,” wrote Steele, due to the volume and sensitivity of personal information it handles daily. However, there’s an “almost complete absence of reports” from other GN departments, according to the commissioner. It likely means “that other units of government are not aware of their reporting obligations under the Access to Information and Protection of Privacy Act (ATIPPA), or do not recognize privacy breaches as such when they occur,” he wrote.
Another area the commissioner says needs to improve is the GN withholding information when the reasons don’t fit any of the exceptions under ATIPPA.
There are two types of exceptions ATIPPA grants when withholding information from the public: mandatory and discretionary. The mandatory exception states that the GN has no choice but to withhold information if conditions are met. Under discretionary, the GN may withhold information if conditions are met, with the added caveat that the government still has a choice to release the information anyway.
“The problem is that, in the cases we see, the GN almost never exercises its discretion. If the conditions for the exception are met, the GN treats it as ‘case closed,’” Steele wrote. “That is legally wrong, but the GN keeps doing it.”
To illustrate the ongoing nature of this concern, the annual report cites a case from 2004 in which Keenan Bengts wrote: “the current system for applying discretion is not working. It is, in fact, a non-system. As a result, the statutory requirements of the ATIPPA are routinely unmet, as they were in this case.”
Steele highlighted an instance from the past year when an applicant requested information related to security concerns at Nunavut’s COVID-19 isolation hubs. Although the documents released by the Dept. of Health were heavily redacted, the commissioner found that the exceptions were properly applied in some respects. However, he determined that the redacting the names of government contractors and its officers and employees was an example of GN being unable or unwilling to exercise its discretion, as required by law.
On a more positive note, the report states that within the last few months of Keenan Bengts’ work, she did as much as possible to clear any backlogs of the ATIPPA system. As a result, Steele commented, “I can report that Nunavut ended the 2021-22 fiscal year with a backlog of zero.”
Zero backlog mean ATIPPA requests can be turned around in “a few weeks or less,” says Steele, who adds if there is a bottleneck in the system, it’s not in the commissioner’s office.
In terms of the office’s priorities for the next five years, Steele says he hopes to help further amend and review the ATIPPA. This would include giving the commissioner the power to order the disclosure of documents.
“This could and should be done right away. About half of Canadian jurisdictions already have this power. It was recently done in the NWT,” he states, adding that Nunavut is still dealing with a first generation ATIPPA law, going back to pre-territorial division days.
Health-specific information legislation, increased capacity for the commissioner’s office, and finding an Inuk or long-time Northerner successor are also on the table.
“I believe this position should eventually be filled by someone who is fluent in Inuktut and is able to move the work of this office forward according to the spirit of Inuit Qaujimajatuqangit,” Steele stated.
The information and privacy commissioner is an independent officer of Nunavut’s Legislative Assembly, appointed under the ATIPPA.