Presentation: Dealing with data breaches

This past weekend, I had the pleasure of being invited to speak at the Canadian Corporate Counsel Association's annual spring training for new in-house counsel. My portion of the presentation focused on dealing with data breaches and investigations by Canadian regulators.

Here's a copy of the presentation, in case it's of interest:

In case you can't see the embedded presentation, follow this link: https://docs.google.com/present/view?id=ddpx56cg_438dq7nkrdc&interval=30.

Missing Alberta health care provider hard drive had thousands of patient images

An unencrypted hard-drive has gone missing at Covenant Health in Alberta, leading to an investigation by the province's Information and Privacy Commissioner. The drive, it appears, contained exclusively images, but many of them would be considered to be highly sensitive including video of surgeries. The names and hospital numbers of the 3,600 relevant patients are also apparent from the directory and file naming systems. The drive apparently went missing when an employee was moving offices. Because it was not a "portable" drive, the data was not encrypted.

See: Missing hard drive had thousands of patient images - Calgary - CBC News.

Heartland data breach could be bigger than TJX's

Heartland Payment Systems has announced that it suffered a significant data breach last year after it was discovered that hackers had installed software on their systems to capture credit card information. The firm apparenly processes over 100 Million tranactions a month, leading to speculation that this may dwarf the 2007 TJX breach. See: Heartland data breach could be bigger than TJX's.

Nova Scotia review officer considers investigation of WCB over misdirected file

Last week, the Halifax Chronicle Herald reported that the provincial Workers' Compensation Board mistakenly sent the wrong person's file to an individual who was contesting his claim under the program.

It looks like it was a one-off error:

WCB sends wrong file to man - Metro - TheChronicleHerald.ca)

.... MacLean insists the board does not often mix up its clients and she can’t remember the last time a file was mailed out in error.

"Our employees all go through (Freedom of Information and Protection of Privacy Act) and privacy breach training and we take this all very seriously."

And they have procedures to follow if something does go awry.

To help avoid personal information falling into a stranger’s hands, she said the envelope is stamped with a warning message that asks the recipient to alert the board if the received the envelope in error. It also asks the recipient not to open or destroy its contents.

However, she admitted, she didn’t know how anyone could tell if the file wasn’t theirs without first opening the envelope and reading the contents.

The board is mailing Kinsman his correct file, MacLean said.

Today the paper is reporting that the newly established Privacy Review Officer is considering an investigation: Privacy watchdog mulls probe of WCB - Front - TheChronicleHerald.ca.

I'm not sure that this error indicates any sort of a systemic problem, but I expect we'll hear more about it in the future.