NorQuest College scrambling to reassure staff after massive privacy breach kept secret

More than three years after discovering a massive privacy breach that included confidential employee information, NorQuest College president Jodi Abbott is scrambling to reassure staff the college properly handled the situation.

Abbott never told the college's employees that in April 2013 NorQuest officials discovered a "vast quantity" of confidential information on the personal computer of former information technology (IT) manager Clarence Orleski.

CBC News publicly revealed the breach, and two alleged frauds, earlier this month, using documents the college filed years ago in its civil court case against the former manager.

Court documents show Orleski's personal computer contained the confidential salary information of all 600 employees, copies of disciplinary letters, interview notes from internal investigations, personal emails between employees and their spouses, even the president's employment contract.

In a Sept. 16 email to all NorQuest staff, obtained by CBC News, Abbott said the college had reason not to inform its employees.

"Legal counsel advised us that due to a pending potential criminal investigation by Edmonton Police Service (EPS), ongoing litigation, restrictions around the use of seized records, and emerging evidence of an alleged fraud perpetrated against the college, there was a risk that broad disclosure of the privacy breach would hinder both the criminal and civil investigations," Abbott wrote.

College covered up privacy breach, former employee says

But a former NorQuest employee, who had direct knowledge of the events surrounding the privacy breach, said the college's biggest concern at that time was covering up the embarrassing privacy breach and the two alleged frauds.

"They were very happy that when the lawsuit was filed, no reporter found it," said the former employee who spoke on condition of anonymity. "They saw it as a godsend."

The former employee said several people from the president's office, human resources, and the IT department, who knew about the privacy breach and alleged frauds, were made to sign non-disclosure agreements that threatened dismissal.

"That is part of why it is a joke about them not only not telling their employees about the breach but actively, from the very start, covering it up," the former employee said.

Edmonton police have confirmed NorQuest filed a criminal complaint but one man who admits his involvement in the alleged frauds told CBC News he has never been contacted by anyone from EPS over the past more than three years.

Privacy expert Linda McKay-Panos also doesn't buy the explanation that the privacy breach was kept secret for legal reasons, given that NorQuest provided detailed information about the breach and two alleged frauds in court documents it knew would be public.

"It just seems to me that because of the nature of the information that was on there, as soon as they found it, it would have been a best practice to at least let those individuals know so they could take steps to protect themselves," said McKay-Panos, executive director of the Alberta Civil Liberties Research Centre.

Another search of seized data planned

Abbott, in the email, also downplayed the size and severity of the privacy breach, saying the college's initial investigation determined Orleski had access to "limited personal information" from the vast majority of NorQuest employees.

"However, to further reassure everyone, an additional search of the data will be conducted," she wrote.

McKay-Panos said it is clear the college may have prematurely assumed its employees' confidential information was not at risk of being transferred to a third party.

"My fear, for the people whose information was in that computer, is an assumption [by NorQuest] that it wasn't already otherwise revealed to some other people, and the use that could be made of that data," she said.

"I think people have the right to know that their information was not secure and that they need to take steps to start watching, at minimum, that someone might be using their identity."

Abbott's email also does not explain why the college did not disclose the breach to Alberta privacy commissioner Jill Clayton.

The commissioner has already launched an investigation into an individual privacy complaint from a NorQuest employee. Clayton has encouraged other employees to file complaints so her office can expand the investigation.

In the email, Abbott said the college will now meet with Clayton's office "to share with them the unique facts in this matter and our approach."

Union, faculty association express concern

Abbott has not responded to several interview requests from CBC News and the college has refused to directly answer questions.

Both the college's faculty association and the Alberta Union of Provincial Employees have asked the college to provide more information. The AUPE is also considering filing grievances against the college for its handling of this issue.

The court documents detailing the privacy breach are part of a lawsuit NorQuest filed against Orleski. The college alleged Orleski and several others were part of two separate "kickback" schemes that, taken together, cost NorQuest nearly $2 million over five years.

Orleski and the defendants who filed statements of defence denied the allegations and none were proven in court. The college dropped its lawsuit in January 2016. Through his lawyer, Orleski declined an interview request, saying the terms of the agreement are confidential.

@jennierussell_ @charlesrusnell

If you have information about this story, or information for another story, please contact us in confidence at cbcinvestigates@cbc.ca