‘Culture of caution’
More care needed navigating digital world: privacy czar
Saskatchewan’s privacy commissioner says it’s time for “a culture of caution” for government organizations and the public as they navigate the digital world.
In his annual report, commissioner Ron Kruzeniski outlines nine areas of concern, including security breaches from inside workplaces, hacking from outside, as well as how government employees store emails and use smartphones.
Kruzeniski said one employee conduct that is worrisome is when a worker clicks on an attachment or a link in an email that could let in a hacker.
“I have no doubt that we will have to spend a lot more time and energy collectively as a society protecting ourselves against this,” he said Wednesday.
“It appears that hackers have found an economic reason for doing so, whether it’s ransomware or identity theft and/or selling data that they’ve mined by hacking into systems all over the world, it pays off.”
Kruzeniski said he doesn’t think the risk can be eliminated, but it must be reduced.
He said officials should have separate email accounts for personal and work use, and work data should be on a government server.
Premier Brad Wall was criticized by the NDP Opposition last month for using a private email server to do government business.
Wall initially stood by the decision to use personal email accounts while working at home or on weekends. But a spokeswoman from the premier’s office later said he would only use government email to remove any concern.
Kruzeniski also raised concerns about privacy breaches on mobile devices.
He said employers need to be clear about what staff can do with their work-issued smartphones, particularly because those phones could have personal or health information about someone. The commissioner said there is a risk of privacy breaches if there is a lack of strong policies and enforcement on smartphone use.
Richard Murray, deputy minister of Central Services, said people can use work phones for limited personal use, but children and spouses should not have access to them.