Boxes of private, personal records left exposed in government office for weeks

Fifty boxes of records containing "sensitive personal information" spent nearly three weeks sitting in a central area of the Grand Falls-Windsor Department of Transportation and Works depot this spring, according to Donovan Molloy, the province's privacy commissioner.

"It's one of the most serious inadvertent breaches that I've seen in my term as commissioner," he said.

The boxes were discovered when the department decided to reopen its Bishop's Falls depot. They were languishing inside the old building, and many of them were torn or partially opened, Molloysaid.

So they were moved to the depot in Grand Falls-Windsor, he said, but were placed in a central, unsecured area that was frequented by staff.

"A significant number ofpeople were able to walk by those boxes, and with some of them being open, you could see the documentation inside."

• N.L. government breaking its own laws on access to info requests: commissioner
• Sunshine list screw-up: privacy breached for 2nd year in a row

That documentation included social insurance numbers, notes from doctors and even a resignation letter, he said.

And though someone had used plastic wrap to try to secure the boxes, "it wasn't a challenge to anybody who might be nosy and wanted to look at the documents," he said.

Managers told twice

Molloysaid an employee first noticed the documents and gave managers a heads-up about them on April 23. A week and a half later, they were still there, so the employee called Molloy's office.

He contacted a senior executive with the department, butsaid the boxes still sat there for another five days before they were finally moved.

If the top isn't taking privacy seriously, it's hard to expect that employees will.- Donovan Molloy

Molloysuggested they contact the people whose private information was exposed, but management "simply said no," he said.

"[Which], frankly, portrays an attitude which is incredibly disappointing," he said, adding that the actions of the employee to report the boxes were both responsible and commendable.

"The attitude, especially of the management of the department, is really wanting."

Privacy commissioner investigates

Molloy'soffice investigated and released a report last week, he said.

During that investigation, he said, the depot's management came around a bit and agreed that the people who had sensitive information in the boxes ought to know about it, and contacted them.

The department has 10days to respond tothe report, and Molloy said he'shoping tosee even more attitudinal adjustments.

"I'm hoping to get a response which recognizes the seriousness of this matter and a commitment to make sure that nothing like this happens in the future," he said.

"There has to be a privacy culture in a public body department that starts from the top and works its way down. If the top isn't taking privacy seriously, it's hard to expect that employees will."

With files from Newfoundland Morning

Read morefrom CBCNewfoundland and Labrador