Police report privacy breach
The Regina Police Service is grappling with an accidental privacy breach, asking media and community partners to delete an email containing confidential information that was inadvertently issued over the weekend.
The email was sent out at 4:09 p.m. on Sunday to news outlets and parties that typically receive news releases from the Regina Police Service. A watch commander’s log referencing four entries or calls for service was attached to it and contained confidential and personal information. It was recalled four hours later. In a followup email sent out that night to all the recipients, Regina police spokesperson Elizabeth Popowich said the attachment was sent in error, and that the RPS would be reaching out to the Office of the Saskatchewan Information and Privacy Commissioner (OSIPC) on Monday.
The office was contacted because the mix-up potentially constitutes a breach of the Local Authority Freedom of Information and Protection of Privacy Act (LAFOIP). The followup statement asked parties to delete the attachment, which was sent to approximately 39 addresses, including radio stations, news outlets, journalists and school division officials.
“Even though it was released by mistake, we are obligated to report the breach and work with the OIPC to mitigate the effects of our error and accept suggestions to prevent such an error in the future,” said Popowich in the statement.
To contain the breach, police asked all recipients to delete the attachment and notify the FOIP (freedom of information and privacy) co-ordinator for the Regina Police Service. Anyone who did see the attachment is asked to keep the information confidential and not distribute it any further.
If someone uses information from the log, the RPS said, it will proceed as if the instructions to delete the email were ignored.
Police forces in Saskatchewan became subject to the LAFOIP Act in the fall of 2017, a move some chiefs had openly opposed, including former RPS chief Troy Hagen.
LAFOIP gives a person the right to access records concerning them, as long as it does not breach any provisions in the act, such as interfering with ongoing investigations. Under the act, police forces are also responsible for personal information in their possession.
According to the RPS website, police protect personal information through safeguards such as computer passwords, policies and procedures and locked file rooms.
Citizens have a right to file a complaint over how their personal information was handed by police under the LAFOIP Act by contacting the province’s privacy commissioner. RPS declined a further interview, and no one from OSIPC was available for an interview Monday.