PRIVACY BREACHED

Sask. privacy watchdog criticizes WCB.

Saskatchewan’s privacy watchdog has taken the province’s Workers’ Compensation Board (WCB) to task for disclosing too much personal health information about a claimant.

The Office of the Saskatchewan Information and Privacy Commissioner released a report Thursday finding a privacy breach after WCB disclosed a woman’s personal information to her employer.

Former privacy commissioner Gary Dickson, who stepped down from his position last month, recommended in his report that WCB apologize to the complainant, attempt to reacquire the information from her employer and investigate why it didn’t follow its own internal procedure that may have prevented the incident.

A spokeswoman with WCB declined to comment, saying it would respond directly to the commissioner’s office.

The complaint stemmed from an appeal decision sent to the woman, who isn’t identified, and to her former employer on Nov. 23, 2011. Dickson noted it contained the woman’s name and such personal information as health diagnoses, tests and treatment.

“It appears that the decision was based on the diagnosis of ‘major depressive disorder’ and ‘anxiety disorder,’” wrote Dickson. “However, the decision speaks of diagnoses and suspected diagnoses of H1N1 flu, lingular pneumonia, acute stress reaction, reactive depression, colds and alcoholic dependence syndrome. Further, the decision also outlines symptoms of the diagnoses such as being ‘teary eyed’ when visiting the doctor.”

Dickson said it’s unclear why the employer needed to know the unrelated medical conditions and symptoms. “Employers have no standing to dispute medical diagnoses, so it is also unclear why the employer would need access to this granular personal information,” he added.

According to the report, WCB maintained the disclosure was justified and allowed by law. It argued an employer would need the information if they wish to provide “employers with a right to request review of compensation being paid,” stated the report. But Dickson noted that in this case, the complainant lost her appeal and no compensation was being paid, so WCB couldn’t rely on that provision.

Even if WCB is authorized to disclose personal information to the employer, it did not follow the need-toknow or data minimization principles, Dickson found. He suggested WCB could have sent a separate letter to the employer giving notice of the decision without the unnecessary personal information.

Dickson said he decided to author the report when it became clear WCB “is not willing to improve its practices.”

In response to a preliminary report in October, WCB declined to act on Dickson’s suggestions at that point in time.

It is not the first time he has raised similar concerns regarding WCB.