WARNING: This story contains details of sexual abuse and intimate partner violence.
British Columbia’s privacy watchdog has sided with a woman suing the provincial government and its victim assistance program over an alleged breach of her sensitive files.
The Office of the Information and Privacy Commissioner (OIPC) has ordered B.C.’s Ministry of Public Safety to hand over the names of two government employees allegedly involved in the breach, including one accused of accessing sensitive files detailing alleged physical and sexual abuse without authorization.
The woman sought services at the Crime Victim Assistance Program (CVAP) after her husband allegedly physically and sexually abused her over several years, according to the lawsuit filed in B.C. Supreme Court last year. Her CVAP file included police statements and other information about her and her children, the suit said.
None of the allegations in the lawsuit have been tested in court.
The woman asked the ministry for access to records about her case, but the ministry and employees argued against releasing the information, saying it would be an unreasonable invasion of privacy that could harm the workers.
The privacy watchdog disagreed, ruling that the woman has a “legitimate interest” in obtaining information “so she can understand how best to mitigate the potential safety risks she faces as a result of the privacy incident.”
Besides names, the ministry has been ordered to provide the woman with the employees’ email addresses, telephone numbers and internal communications containing their questions, concerns, instructions and opinions about the Ministry of Public Safety’s response to the alleged privacy incident. The ministry is in charge of CVAP.
CVAP executive director Marcie Mezzarobba declined to comment on the privacy commissioner’s decision, referring CBC News to the public safety ministry. In a statement, the ministry said it’s “unable to comment on the Office of the Information and Privacy Commissioner’s order as the matter regarding the alleged privacy breach is currently before the courts in civil litigation proceedings and under a publication ban.”
The ministry launched an internal investigation after the alleged privacy breach, according to the OIPC. It also locked down access to the woman’s file so that it doesn’t turn up in searches and has committed to providing more training for staff, the OIPC said.
The woman, who is only identified as Jane Doe in the lawsuit, alleges she suffered “humiliation, trauma,” “collapse of trust in the government,” and “fear of physical harm or death” from her husband as a result of the alleged breach, the suit said.
“I find that the fact that the applicant has unanswered questions about the privacy incident favours disclosure of the information that remains in dispute,” wrote OIPC adjudicator Allison Shamas in her March decision.
Revealing the information also holds the public safety ministry accountable, Shamas said.
Additionally, it means the woman will be able to sue the employees, on top of the government.
The data breach allegedly happened in August 2022, months after the woman reported the alleged abuse to RCMP, according to the lawsuit.
She went to police because she feared her husband would retaliate against her for restarting claims in family court, the lawsuit said. She had fled their home a year prior and was trying to terminate her husband’s parental rights. Two of her children also made police statements.
She also made a video police statement that was transcribed. It detailed a 2013 incident where her husband, who is not named in the lawsuit, allegedly “sexually assaulted Jane Doe for several hours, and repeatedly hit in her head, which caused her to lose consciousness,” according to the lawsuit.
Shortly after, Jane Doe applied to get benefits for counselling with CVAP for her and her children.
More than two months later, CVAP’s then-director Grant McKellar told Jane Doe in an email obtained by CBC News that her “personal information was inappropriately accessed” and apologized to her. McKellar retired in February.
The woman said in the lawsuit that a close relative of her husband works at CVAP.
In her complaint to the privacy commissioner, she alleged that in the days following the alleged breach, her husband “began behaving in a threatening manner” and referenced the police report in her file.
Her lawsuit alleges the public safety ministry and CVAP violated their obligations under the Freedom of Information and Protection and Privacy Act, “were vicariously liable for the actions” of the employees and “owed a duty of care” to the woman to safeguard her private information.
The privacy commissioner previously found that the Ministry of Public Safety “did not fully protect” her information and that she was only notified of the alleged breach 78 days after it happened.
According to a submission from the ministry cited in the commissioner’s latest decision, one CVAP employee disclosed information about Jane Doe’s claim to another employee. That second employee then viewed Jane Doe’s file without authorization, according to the submission.
The ministry initially gave the woman some information about the alleged breach, but withheld identifying the employees, arguing it was an unreasonable invasion of privacy.
In their submissions, the employees also said disclosing the information would “harm their mental health, ability to function personally and professionally, and the well-being of their families.”
Adjudicator Shamas said she has “considerable sympathy” for the employees and any distress they may feel, but wasn’t persuaded that the potential damage to their reputation as a result of the disclosure of their personal information “would be unfair.”
If you’re in immediate danger or fear for your safety or that of others around you, please call 911. If you’re affected by family or intimate partner violence, you can look for help through crisis lines and local support services.
