Violating principle of 'need-to-know' leads to data breach - September 5, 2014
The Office of the Privacy Commissioner of Canada investigated a complaint regarding the improper disclosure of personal information by Aboriginal Affairs and Northern Development Canada (AANDC). The complainant was concerned that AANDC created a document listing individuals who had requested information about a former minister under the Access to Information Act, and that this document was subsequently disclosed to La Presse newspaper. The investigation found that AANDC improperly shared the document with staff who did not have a need-to-know the identities of the requesters, and that the document was ultimately disclosed to La Presse, violating the Privacy Act.
- Whether the document contained personal information.
- Whether AANDC officials who accessed the document had a need-to-know.
- Whether the disclosure of the document to La Presse constituted a contravention of the Privacy Act.
Complaint well-founded
AANDC contravened the Privacy Act by distributing a document containing personal information to officials without a legitimate need-to-know and by being responsible for the ultimate disclosure of this list to La Presse.
AI-generated summary for reference only. Always verify against the official decision ↗
AANDC was recommended to review its policies and procedures for processing ATIP requests to ensure the need-to-know principle is respected, and to report back on the measures taken within six months.
- s. 3 Privacy Act
- s. 7(a) Privacy Act
- s. 8(1) Privacy Act
- s. 8(2) Privacy Act
This summary is informational only and not legal advice.