Regina Police chief calls privacy breach human error

Attributes mistake to ‘fast and furious’ flow of modern information technology

REGINA Regina’s chief of police is downplaying a privacy breach, saying only a small number of people were affected after entries in a watch commander’s log were accidentally sent to media outlets and other community representatives.

“It was a mistake. There’s obviously no malice in it,” said Bray, speaking to reporters during a community appreciation barbecue hosted by emergency services personnel in a Regina park on Tuesday.

An email with an attachment referencing four entries of calls responded to by officers was inadvertently sent out Sunday at 4:09 p.m. to some 40 recipients that typically get news releases from the Regina Police Service (RPS). The log contained confidential and personal information of members of the public. The email was recalled four hours later.

Then in a followup email, RPS advised anyone who received the email to delete it, and that the matter would be turned over to the province’s privacy office.

The watch commander’s log, recorded by a staff sergeant, contains highlights of events that happened over the course of a shift. Bray wouldn’t go into specific details for fear of further compromising the privacy of the individuals affected by the incident.

Bray would not say exactly how many people were affected, only that it was a “fairly small number.” Afterwards, police worked to quickly reach out to those involved, he added.

“It’s something that we were able to get on top of very quickly and work to try and protect those people that were affected,” said Bray.

He would not elaborate on how the email was accidentally sent to 39 recipients beyond saying it was human error.

“I said to our team when we were talking about it, ‘Have you ever sent a text to the wrong person? Have you ever hit send on an email and you thought, oh I shouldn’t have sent that?’ The reality is that happens and technology is flowing fast and furious every day,” said Bray.

He said police are working on solutions to prevent a similar incident from happening in the future. The cause was something within their control, Bray said, and police should be able to make changes to address it.

Because the breach potentially constitutes a breach of the Local Authority Freedom of Information and Protection of Privacy Act (LAFOIP), Regina police contacted the Office of the Saskatchewan Information and Privacy Commissioner (OSIPC).

Ron Kruzeniski, the province’s privacy commissioner, confirmed Tuesday that his office is now looking into the incident.

Kruzeniski said the critical steps in responding to such breaches are to contain them, and then plan how they can be prevented in the future.

Given how much public-service organizations rely on email, Kruzeniski said a privacy breach happening through email is a very real risk. IT professionals can only do so much, and the responsibility also rests with people performing manual checks to ensure emails go to the right place.

“I’m sure the person that did this regrets it, and you kind of say, ‘Well, you know this should never happen again,’ but that’s not the world we live in when we’re sending out 40 or 50 emails a day,” said Kruzeniski. “It’s, ‘How can we, for every person, reduce the risks of us sending emails to the wrong people?’ ”

Kruzeniski said his office would be able to provide an update once the investigation is complete.