Boxes of private, personal records left exposed in government office for weeks

Fifty boxes of records containing "sensitive personal information" spent nearly three weeks sitting in a central area of the Grand Falls-Windsor Department of Transportation and Works depot this spring, according to Donovan Molloy, the province's privacy commissioner.

"It's one of the most serious inadvertent breaches that I've seen in my term as commissioner," he said.

The boxes were discovered when the department decided to reopen its Bishop's Falls depot. They were languishing inside the old building, and many of them were torn or partially opened, Molloy said.

So they were moved to the depot in Grand Falls-Windsor, he said, but were placed in a central, unsecured area that was frequented by staff.

"A significant number of people were able to walk by those boxes, and with some of them being open, you could see the documentation inside."

That documentation included social security numbers, notes from doctors and even a resignation letter, he said.

And though someone had used plastic wrap to try to secure the boxes, "it wasn't a challenge to anybody who might be nosy and wanted to look at the documents," he said.

Managers told twice

Molloy said an employee first noticed the documents and gave managers a heads-up about them on April 23. A week and a half later, they were still there, so the employee called Molloy's office.

He contacted a senior executive with the department, but said the boxes still sat there for another five days before they were finally moved.

Molloy suggested they contact the people whose private information was exposed, but management "simply said no," he said.

"[Which], frankly, portrays an attitude which is incredibly disappointing," he said, adding that the actions of the employee to report the boxes were both responsible and commendable.

"The attitude, especially of the management of the department, is really wanting."

Privacy commissioner investigates

Molloy's office investigated and released a report last week, he said.

During that investigation, he said, the depot's management came around a bit and agreed that the people who had sensitive information in the boxes ought to know about it, and contacted them.

The department has 10 days to respond to the report, and Molloy said he's hoping to see even more attitudinal adjustments.

"I'm hoping to get a response which recognizes the seriousness of this matter and a commitment to make sure that nothing like this happens in the future," he said.

"There has to be a privacy culture in a public body department that starts from the top and works its way down. If the top isn't taking privacy seriously, it's hard to expect that employees will."

With files from Newfoundland Morning

Read more from CBC Newfoundland and Labrador