Saanich Mayor Richard Atwell wants the municipality to issue public apologies to everyone who was illegally monitored using computer spyware on District computers.
On Monday, Saanich council will discuss a report from Atwell on the District’s use of Spector 360, the now-defunct employee monitoring software program that unlawfully captured keystrokes and screenshots on computers used by the mayor and senior District officials between Dec. 2 and Jan. 20.
B.C. Privacy Commissioner Elizabeth Denham concluded in March that the District violated the province’s Freedom of Information and Protection of Privacy Act and displayed “a deep lack of understanding” of privacy rules by choosing to install the software as a security measure.
Atwell’s report makes several recommendations including offering public apologies to anyone who was known to be monitored using Spector 360, and requests staff confirm “how and when and by whom the Spector 360 employee monitoring software functions were disabled” and provide details of how collected information was identified and destroyed. The report also discusses the need to establish the duties of a privacy officer who can conduct an audit of the District’s IT systems to report back to council within 60 days of being hired.
Saanich’s interim Chief Administrative Officer Andy Laidlaw told staff in an April 1 internal email that the sensitive information collected by Spector 360 had already been destroyed, and that the District has committed to implementing Denham’s additional recommendations including the hiring of a dedicated privacy officer.
In an interview, Atwell said council should find out specifics on how the data was destroyed, and as elected officials should still provide oversight and clear direction for implementing Denham’s recommendations.
“I could leave it to the CAO to handle things in his own way, but the staff aren’t elected,” Atwell said. “It’s ultimately myself and the councillors who should provide oversight and leadership on this issue and find out what went wrong.”
Under the B.C. Community Charter, discussion about individual employees should be held behind closed doors, so it’s unlikely much of Atwell’s report will receive majority support from councillors on Monday evening.
If approved by a majority of councillors, Atwell’s report would also direct staff to explain several errors from a Jan. 13 District press release about the spyware’s installation. Those errors include District officials’ assertions that “there was no reasonable expectation of privacy by employees” while using workplace computers, and that the spyware was installed in response to conclusions from a May 2014 audit of the District’s computer systems. Denham’s investigation debunked both of those claims.
Atwell’s report also directs the CAO not to fire or discipline any employee in the matter until the District’s finance, audit and personnel standing committee has reviewed his report. The committee is chaired by Atwell and recommends policies on personnel, finance, purchasing and information technology to council.
“It’s up to council to find out what happened because we have to rely on good information to make good decisions,” Atwell said.
FAST FACTS
- On Dec. 2, the Spector 360 employee monitoring software program was installed by Saanich’s IT department on computers used by Mayor Richard Atwell; the fire chief; the CAO, or “city manager”; the directors of corporate services, legislative services, planning, parks and recreation, finance and engineering; two executive administrative assistants; and two workstations shared by councillors. The software was uninstalled on Jan. 20 and the District spent about $2,000 U.S. on training and licensing.
- B.C. Privacy Commissioner Elizabeth Denham released a report on March 30 that made clear the Spector 360 program collected information in violation of the Freedom of Information and Protection of Privacy Act. Denham also concluded the District’s submissions to her office demonstrated “a deep lack of understanding about the most basic tenets of the (Freedom of Information and Protection of Privacy) Act, such as what constitutes the collection of personal information.”
editor@saanichnews.com
