Woman says childhood sexual trauma details leaked in privacy breach
A Dartmouth, N.S., woman whose personal information was exposed in the province's worst-ever privacy breach says the experience has left her angry and hurt.
"I felt violated," the woman said.
CBC News is shielding the woman's identity because the files leaked by the province's online freedom of information portal in March 2018 concerned sexual trauma she experienced as a child.
The woman requested CBC News withhold details of her experience.
But she said her memories are vivid, and she made a freedom of information request for her files to help understand what happened to her 23 years ago.
"I wanted answers about sexual trauma that occurred when I was six," she said.
'Further victimization'
The woman said she received roughly 300 pages of documents in February 2018, most of it deeply personal.
"Assessments, details of the sexual trauma that I had experienced, my birth certificate, interviews with myself as a child," she said. "It confirmed my memories of the trauma that I had experienced."
In mid-April, 2018, she received a letter from the provincial government saying her file was one of more than 7,000 downloaded from the province's unsecured portal.
The records were accessible without a password by incrementally changing numbers at the end of the portal's web address.
"The nature of my request had already been about sexual trauma, so for them to post that for the world to see was further victimization," she said.
Legal precedents
According to a national expert in privacy law, Canada's courts have recognized the harm privacy violations can cause.
"Just having your information exposed to somebody can cause harm, individual psychological harm," said David Fraser of the law firm McInnes Cooper in Halifax.
"That is regardless of whether you know who looked at it. And in some cases it could in fact be worse because you don't know who it is, so you might assume the worst.
"You might think it's somebody who knows you. And now, they know something incredibly intimate and personal about you. And they're looking at you differently."
The privacy victim CBC spoke with said she tries not to think about who might have read her files, but she still has concerns.
"Apart from the risk of serious financial fraud, I worry about harm to my reputation, as well as the perpetrator of the sexual trauma possibly retaliating against me," she said.
Compensation precedent
Fraser said the Ontario Court of Appeal has ruled that financial damages are appropriate for victims of a privacy violation, ranging from a nominal amount to up to $20,000.
After hearing the details of the Dartmouth woman's case, he believes it would fall at the serious end of the spectrum.
"That's at the top of the range. That's 20,000 bucks immediately just for the psychological harm. And also, if for example, if the person loses work as a result, that's real money damages as well that could be piled on top," said Fraser.
He said how someone is affected by a privacy breach varies from person to person.
In some cases, he said it can result in disabling psychological injuries.
"For some other people, it might be something that they can shrug off. So it's [an] incredibly, deeply personal thing," said Fraser.
The woman told CBC News she doesn't want to discuss legal action or compensation, only to share how the privacy breach impacted her, and to hold the province to account.
'It was a flagrant error'
Nova Scotia's information and privacy commissioner, Catherine Tully, said the errors that led to the freedom of information portal breach were "jaw-dropping."
The woman said she doesn't believe assurances the province has learned from its mistakes.
"I trusted the Department of Internal Services with my medical information. And when that was released without my authorization, that trust was broken," she said.
The woman also has words for Internal Services Minister Patricia Arab.
"It was incompetent … it was a flagrant error and she should own that," she said.
Premier defends minister
In a statement released Tuesday, Premier Stephen McNeil defended Arab.
"I have full confidence in the minister's commitment to make the necessary improvements to ensure the private information of Nova Scotians is protected," part of the statement read.
