DND broke privacy rules: commissioner
OTTAWA — Canada’s privacy commissioner has found the federal government broke privacy rules when it revealed the identity of a Postmedia reporter to Irving Shipbuilding last March.
In a recent letter to Conservative MP Peter Kent, who filed complaints about the issue earlier this year, the privacy commissioner’s office concluded the Department of National Defence (DND) contravened the disclosure provisions of the Privacy Act when an employee “inappropriately disclosed the journalist’s information to a third party who did not have a need to know.”
The privacy commissioner decided that Kent’s complaint was “well-founded and resolved,” given that the department has already conducted an internal investigation and plans to provide additional training to its employees as a result of the privacy breach.
In March, Postmedia reporter David Pugliese sent questions to DND and Public Services and Procurement Canada (PSPC) about possible problems with the welding on the first of six Arctic patrol ships Irving is building for the Royal Canadian Navy.
Ninety minutes after submitting the questions, and before either department had responded, Pugliese received an email from an Irving representative saying the company had been made aware of his inquiry. In a subsequent telephone conversation, Irving Shipbuilding President Kevin McCoy threatened legal action against Postmedia, saying Irving’s lawyers would be “making sure you understand that if you write something false about our reputation we will pursue it.”
DND later confirmed there were minor welding problems with the ship, but nothing requiring it to be docked for repairs.
The two departments subsequently acknowledged they had provided Irving with Pugliese’s name and said they were investigating whether they had violated federal privacy law. They also said they had directed employees to make media requests anonymous going forward.
McCoy later told the Senate finance committee that Irving had threatened Postmedia with legal action because federal officials had warned the company that a Postmedia reporter was making “very wild accusations” about the ships.
“We were concerned about our reputation and the (government’s) shipbuilding strategy’s reputation,” he said.
But DND then provided Postmedia with a copy of its correspondence with Irving, which stated only that Pugliese had been told there were welding problems and was seeking comment. The department denied it told Irving that Pugliese was making “wild accusations.”
The Privacy Act states that the government shall not share personal information without “the consent of the individual to whom it relates,” with a few exceptions. According to the letter to Kent, dated July 10, the office of the privacy commissioner has concluded that the government’s decision to alert Irving to Pugliese’s identity “constitutes a contravention of the disclosure provisions of the Act.”
The letter indicates that DND plans to review certain policies and procedures to prevent similar breaches from occurring in the future. The office has asked the department to submit its revised policies when the review is complete.