Complaint response inappropriate: privacy czar

Commissioner recommends Hodgeville council, staff receive additional training

A Saskatchewan village’s officials say a lack of direction in the province’s Municipalities Act led to a decision to reprimand a councillor during a public council meeting.

The provincial privacy commissioner found officials with the Village of Hodgeville failed to investigate the subsequent breach of privacy complaint stemming from the reprimand, and instead forwarded the complaint letter to members of council in an email. Recipients were then encouraged to share the letter on social media.

Hodgeville, a community of fewer than 200 people near Swift Current, was found to have inappropriately responded to the original complaint last fall and did not have the authority to disclose it. In his Aug. 16 report, Saskatchewan Information and Privacy Commissioner Ron Kruzeniski said there were multiple privacy breaches associated with the incident, including the use of personal email servers for official village business.

The matter stems from an incident at a village council meeting in July 2017, between a councillor and a local businessman.

At the subsequent August council meeting, the councillor was reprimanded for using derogatory language and being disrespectful in an open council meeting, rather than behind closed doors.

The councillor submitted a written complaint to the village on Nov. 21, 2017, charging it with a breach of privacy. The complaint letter was then sent to the personal email accounts of other members of council, and to the village’s email account.

Kruzeniski identified the village mayor’s personal email account as the source of the forwarded message. Recipients were then asked to post the letter on social media.

The complainant told Kruzeniski the letter was also printed out and copies were being read by members of the public present at the Nov. 21 council meeting.

Kruzeniski wrote that the village, when it received a breach of privacy concern, had an obligation to respond to the concern and treat the identity of the complainant as personal information.

“Forwarding an email to all council members encouraging them to share the breach of privacy complaint and post to social media is not an appropriate disclosure of information,” he wrote. He also found that privacy regulations weren’t considered before any disclosures were made.

He also learned the village didn’t believe the original complaint was related to a privacy breach and it did not intend to respond.

“It is best practice for a public body to respond to an individual’s privacy breach complaint, whether the public body is of the opinion it is valid or not. As such, the village did not respond appropriately to the Complainant’s privacy breach complaint,” Kruzeniski wrote in his report.

In two reports related to the breaches — both the August and November incidents — he recommended the village develop a policy for collecting and disclosing information for the purpose of managing code of conduct complaints, and that all employees and councillors receive annual access and privacy training. He also recommended the village apologize to the complainant.

Last Thursday, the village’s chief administrative officer, Raegan Minifie, delivered a statement on behalf of “a majority ” of the council, thanking the privacy commissioner for the recommendations.

The statement addressed the first breach that set off the chain of events.

“In this instance, the complaint was made by a councillor after they were reprimanded in public for taking it upon themselves to refuse to help and slurred a member of the local fire department, while acting on behalf of all of council. Their actions were done publicly, as a council representative, so a majority of council felt that the reprimand should be made in public as well.”

The statement went on to say that neither the provincial Municipalities Act nor the Village of Hodgeville bylaws states that these matters must be dealt with in an in-camera session.

“Therefore, until the provincial government makes legislation that forces them to deal with council reprimands privately, it’s up to council to decide how each matter is handled,” she read.

Minifie said she had not read the final recommendations herself, but had read a draft version. The village is expected to review the recommendations within the next month.

Kruzeniski also spoke out against the use of personal accounts for council business by the mayor, council and the village’s email due to information security concerns. All are either Sasktel or Hotmail accounts.

When his office asked why councillors use personal email accounts to conduct village business, he was told it has always been done that way, he noted in his report.

He recommended the village set up email accounts for councillors to use when conducting official business.

It is best practice for a public body to respond to an individual’s privacy breach complaint ... the village did not respond appropriately ...