Saanich’s top bureaucrat and B.C.’s Privacy Commissioner Elizabeth Denham privately sparred over comments Denham made following her investigation into the municipality’s use of spyware, documents obtained by Saanich News reveal.
The correspondence also reveals which Saanich staff members were interviewed by privacy investigators.
In an April 2 letter to the Office of the Information and Privacy Commissioner, Saanich’s Chief Administrative Officer Andy Laidlaw takes exception to a March 30 press release in which Denham states that one of the most disappointing findings from her investigation was Saanich’s “near-complete lack of awareness and understanding of the privacy provisions of B.C.’s Freedom of Information and Protection of Privacy Act (FIPPA).”
Laidlaw details how Denham’s public comments have left staff demoralized and that council and citizens are now questioning their level of confidence in the District’s programs.
“You have a position of influence and while your intent may have been to link your statement only to your limited-scope investigation, it has been interpreted in a much broader scope,” Laidlaw writes to Denham.
The municipality installed Spector 360, an employee monitoring software tool, on the computer of Mayor Richard Atwell and on 12 other workstations last December. Denham launched an investigation after Atwell went public with his concerns on Jan. 12. She concluded Spector 360 intrusively collected personal information in contravention of privacy rights at the workplace, and recommended an overhaul of the District’s privacy program.
(PHOTO: Saanich interim CAO Andy Laidlaw)
Laidlaw reasons those conclusions are restricted only to “the limited number of interviews conducted and the narrow scope of material reviewed for the Spector 360 software program investigation” by OIPC staff.
He continues: “Had we known that you were planning to make a broad statement about our entire program, we would have recommended additional interviews and questioned why your staff declined an interview with our Director of Legislative Services.”
Carrie MacPhee, Saanich’s director of legislative services, is responsible for the District’s compliance with privacy laws. She is currently serving as acting CAO while Laidlaw is on vacation. When contacted by the News, MacPhee said it would be premature to comment because Saanich council is awaiting a closed-door report on the spyware investigation from Laidlaw.
In his letter, Laidlaw asks Denham to clarify whether her comments about Saanich’s poor understanding of privacy law apply to the “limited-scope investigation” she conducted, or whether they were meant as a broad statement.
Denham’s April 9 response leaves little room for interpretation. She first details how Saanich staff failed to provide adequate justification for violating privacy law.
“When my staff first requested that the District provide its position on how its collection, use, or disclosure of personal information by Spector 360 was authorised by FIPPA, we were provided with the following single sentence: ‘[t]he purpose of Spector 360 was to protect and secure the computers of high profile users,'” she writes.
(PHOTO: Elizabeth Denham, B.C. Information and Privacy Commissioner)
Denham adds Laura Ciarniello, Saanich’s director of corporate services, then provided new information to the privacy commissioner’s office on Feb. 10.
“The content of those submissions displayed what can again be fairly described as a near-complete lack of understanding of FIPPA and its application to the District,” Denham says. “It is not credible that a public body with an understanding of privacy law or of FIPPA could have drafted submissions that fundamentally misapplied the relevant sections of that Act.”
In response to Laidlaw’s statement that the OIPC “declined an interview” with MacPhee, Denham writes that only four names were provided to her office for interview during her Spector 360 investigation: Ciarniello, Laidlaw, assistant IT manager John Proc and IT manager Forrest Kvemshagen.
The OIPC conducted those interviews on Feb. 3, after which MacPhee’s name was provided as “an employee who was an example of a computer user who had Spector 360 installed on his or her computer,” Denham writes.
Denham says her staff declined to interview MacPhee because by that point they had already gathered enough information on how staff were notified about the spyware.
“At no point during our investigation was the Director of Legislative Services or any other District manager or officer identified as the person responsible for FIPPA compliance within the District,” Denham continues.
Denham also notes that MacPhee was present at a Nov. 19 meeting – in which senior staff discussed the implementation of employee monitoring software and decided to install it on the computers of Atwell, the fire chief, the CAO and other senior staff. Denham says she can find no evidence that anyone raised concerns about privacy compliance in that meeting.
“The only District employee who questioned the privacy invasiveness of the use of Spector 360 was the IT Technician who was tasked with its installation,” Denham writes. “As described in the Investigation Report, that person voiced his concern but was specifically directed to install the software with the most privacy intrusive functions enabled.”
Denham concludes by defending her previous statements that Saanich staff displayed poor comprehension of privacy law.
“I therefore respectfully suggest that these circumstances describe a public body in which management was not aware of its privacy obligations under FIPPA and that my public comments in this regard are validly founded.”
When contacted by Saanich News, an OIPC spokesperson declined further comment.
Read the letters in full below.
editor@saanichnews.com
FOI – Andy Laidlaw – April 2, 2015 by Daniel Palmer
