N.W.T. gov't and former employee settle case over alleged privacy breach

A former manager in the N.W.T. Justice Department has been ordered to destroy all records he has about his old colleagues, putting an end to a months-long skirmish over employee privacy between him and the territorial government.

"[The government] sued me, we settled, I think I'm done ... for now," Donn MacDougall said in an email.

The former manager in the Justice Department's securities division said he has reached a settlement with the territorial government after it took legal action against him over his website, infobreach.ca.

The website detailed allegations that the government breached employees' privacy. In making his case, MacDougall published identifying information of his former colleagues.

MacDougall emailed CBC a copy of the order of the Court of Queen's Bench of Alberta dated March 20.

It directs MacDougall to destroy all records containing identifying information that came to him after the end of his employment as a result of "irregularities" in PeopleSoft, a human resources management system.

The document says if the court order is followed, no payments will be made to any party.

MacDougall's website has been updated to reflect the development.

The infobreach affair

MacDougall said he first alerted the government to issues with PeopleSoft five years ago.

On infobreach.ca, he alleged that he still had managerial access to his PeopleSoft account nine months after his employment ended in 2014. MacDougall said this gave him access to other employees' timesheets and leave balances, including sick leave.

He used screenshots that appeared to reveal private employee information to substantiate these and other claims.

MacDougall scrubbed his website in December, saying he received a cease and desist request from the territorial government.

He subsequently emailed CBC News a copy of a Dec. 20, 2018 notice signed by a Justice Department lawyer. It said if MacDougall didn't take down the website, the government would "pursue any and all legal remedies available to it."

Didn't sue per se, gov't says

MacDougall said court action could have been avoided. He said he told the government via email on Jan. 2 that he wasn't going to re-post any of the personal information, but no one saw the email.

"Long story short, they sued me anyways," MacDougall said on Friday.

In the course of obtaining evidence as part of the lawsuit, he said, it was revealed that his message ended up in a spam folder. He said the email was deleted before it was read.

"This is just another example of the poor data management practices that the GNWT [Government of the Northwest Territories] engages in," said MacDougall.

Richard Robertson, a Justice Department spokesperson, said in an email that the government couldn't respond to CBC's specific questions.

Robertson said the government didn't sue MacDougall, per se.

"The GNWT brought a special kind of court action to stop unauthorized disclosure of private information," he wrote. "This is not the same as 'suing' someone for money or for other material gain."

Robertson confirmed that the litigation ended with the government and MacDougall agreeing to a court order instructing MacDougall to never again disclose private information obtained through "irregularities in PeopleSoft," and to destroy the records of the private information that he has.

Duty to protect privacy

A key question remains is whether MacDougall had a duty to protect private information he got through "irregularities" in the government's human resources system when he was no longer employed by the government. The court order stops short of an answer.

He said the government went to court arguing that he revealed information that came to him through an "inadvertent disclosure of information." MacDougall said what happened with PeopleSoft was a "negligent disclosure of information."

MacDougall said he and the government now agree that he got personnel data through an "irregular disclosure of information."

"The use of the word 'irregularities' is very important to me," he said.

"There's an acknowledgment that no, this was due to irregularities. Something went wrong, and it wasn't me."

Citing the case last May of a stolen laptop that contained health data of thousands of territorial residents, MacDougall said it appears the government doesn't "have the skills to even recognize a data breach."

"What I really hope," he said, "is that these are really irregularities and that it's not something that's routinely done and just never detected."