Richard Atwell's spyware allegations vindicated by privacy commissioner
Saanich Mayor Richard Atwell’s concerns about spyware on his office computer at city hall were legitimate, says a report from B.C.'s information and privacy commissioner.
Atwell claimed earlier this year that the software was being used to spy on him by recording his keystrokes and taking screen shots.
While Privacy Commissioner Elizabeth Denham's report doesn't deal directly with Atwell's allegations, she found that the security software installed by city staff collected far more information than allowed under the Freedom of Information and Privacy Act.
"When the District of Saanich implemented employee monitoring software, staff enabled tools that would collect sensitive personal information from employees including personal websites visited, online banking transactions, confidential correspondence and private passwords or images," Denham said in her report.
Not authorized by privacy law
"The district can only collect personal information that is directly related to and necessary for the protection of IT systems and infrastructure. An employee's every keystroke and email, or screen captures of computing activities at 30-second intervals clearly exceeds that purpose and is not authorized by privacy law."
Denham said the District of Saanich failed to provide adequate notice of the amount and type of information it was collecting. She ordered the district to destroy the data and said the district has agreed to do so.
The Saanich mayor made national headlines in January after alleging staff used a program called Spector 360 to track his actions on his computer, while the district said it was simply following through on recommendations from a security audit that recommended the software.
Saanich police conducted their own investigation and found nothing wrong with security software installed on Atwell's computer.
Denham said she was surprised by the district's ignorance of privacy laws.
"One of the most disappointing findings in my investigation is the district's near-complete lack of awareness and understanding of the privacy provisions of B.C.'s Freedom of Information and Protection of Privacy Act," she said. "The law has been in place for more than 20 years, yet the district appears to not understand its most basic privacy provisions."
The District of Saanich removed the Spector 360 spyware from its computers in January when Denham first announced her investigation.
She recommended that the district appoint a chief privacy commissioner to audit the district and provide training to ensure it meets privacy obligations.
