Privacy commissioners in B.C., Ontario order LifeLabs to improve security

Privacy commissioners in B.C., Ontario order LifeLabs to improve security

VICTORIA — One of Canada’s largest medical services companies failed to put in place reasonable safeguards to protect the personal health information of millions of Canadians, say the privacy commissioners in B.C. and Ontario.

LifeLabs revealed last November that hackers gained access to the personal information of up to 15 million customers, almost all in Ontario and B.C., and that the company paid a ransom to retrieve and secure the data.

The breach was determined to have affected millions of Canadians and the privacy commissioners announced their joint investigation in mid-December.

A statement released Thursday by the commissioners says the breach last year broke Ontario’s health privacy law and B.C.’s personal information protection law.

The joint investigation found LifeLabs collected more personal health information than was necessary, failed to protect that data in its electronic systems and relied on inadequate information technology security policies.

B.C.’s privacy commissioner and health minister say the investigation shows that provincial legislation should be changed to allow fines against companies that don’t protect personal information.

Michael McEvoy, the information and privacy commissioner of B.C., said the size of the breach was largest he has investigated.

“This the most significant privacy breach I’ve ever seen in British Columbia as privacy commissioner and I think that our office has seen in many years,” he said in an interview.

Both the Ontario and B.C. offices have ordered LifeLabs to address shortcomings through measures that include improving its security systems and creating written policies and practices regarding information technology security.

But McEvoy said the health care company has opposed the release of the commissioners’ report on the grounds it contained confidential and privileged information.

“LifeLabs said today, in a press release, that it’s been open and transparent from the outset of this matter and we hope that in the spirit of that openness and transparency, they will drop any objections they have to the full publication of our investigation report,” he said.

B.C. Health Minister Adrian Dix backed that call.

“Public interest lies in more information being provided to build public confidence, and that’s how you respond to these things,” he said. ”LifeLabs is a great company and a great partner but what this has shown is they, and all of us, have to do better.”

LifeLabs says it has accelerated its strategy to strengthen its information security systems, including appointing a chief information security officer to lead the improvements.

The company said it has also made efforts to improve its information security management program with an initial $50 million investment and has hired a third-party service to evaluate its response.

“What we have learned from last year’s cyberattack is that we must continually work to protect ourselves against cybercrime by making data protection and privacy central to everything we do,” LifeLabs said in a statement.

Dix, who hasn’t seen the privacy commissioner’s report, said the government made changes in its contract negotiations with LifeLabs after the data breach. Those include provisions that strengthen privacy considerations and offer a place to incorporate the recommendations from the joint investigation, he added.

McEvoy also called for his office to be given the ability to fine companies who breach privacy laws, which Dix said he supported.

Ontario commissioner Brian Beamish says the breach should serve as a reminder to organizations, big and small, that they have a duty to be vigilant.

“I look forward to providing the public, and particularly those who were affected by the breach, with the full details of our investigation,” Beamish said in a statement.

The privacy commissioners said they have given LifeLabs 14 days to take them to court to oppose the release of the report.

This report by the Canadian Press was first published June 25, 2020.

The Canadian Press

Business

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

There were 410 COVID-19 cases recorded in Alberta Wednesday. (File photo)
Alberta records 410 new COVID-19 cases Wednesday

Central zone dropped to 160 active cases

Shaun Isaac, owner of Woodchucker Firewood in Trochu, is awaiting a new shipment during a firewood shortage in the province. All of the wood he has left is being saved for long-time customers who need it to heat their homes. (Contributed photo).
Firewood shortage in central Alberta caused by rising demand, gaps in supply

‘I’ve said “No” to more people than ever’: firewood seller

Front-line hospital workers have walked off the job at the Rimbey Hospital, and across the province. Photo Submitted
Front-line health care workers on strike across the province, including Rimbey Hospital

The strike is due to cut of 11,000 health care jobs in the province, according to AUPE

Alberta’s chief medical officer of health, Dr. Deena Hinshaw, confirmed more than 1,000 cases over the weekend Monday afternoon. File photo
COVID-19: Central zone active cases up Monday

‘We’ve now crossed the tipping point,’ says Hinshaw

Royal Alexandra Hospital front-line workers walk a picket line after walking off the job in a wildcat strike in Edmonton, on Monday, October 26, 2020. THE CANADIAN PRESS/Jason Franson
Alberta labour board orders health-care staff who walked off the job to go back to work

Finance Minister Travis Toews said in a news release that he was pleased with the labour board’s decision

Husky Energy logo is shown at the company’s annual meeting in Calgary on May 5, 2017. THE CANADIAN PRESS/Jeff McIntosh
Husky pipeline spills 900,000 litres of produced water in northwestern Alberta

The energy regulator says environmental contractors are at the site

A raccoon paid a visit to a Toronto Tim Hortons on Oct. 22, 2020. (shecallsmedrew/Twitter)
Who are you calling a trash panda? Raccoon takes a shift at Toronto Tim Hortons

Tim Hortons said animal control was called as soon they saw the surprise visitor

Sharon Hickin, general manager of the Days Inn Sylvan Lake and the new Lake House Diner, poses for a photo outside the new restaurant. Photo by Megan Roth/Sylvan Lake News
Pandemic puts extra hurdles in place for new Sylvan Lake businesses

Over the past seven months numerous new businesses have opened in Sylvan Lake, despite the pandemic

file photo
Maskwacis RCMP investigate pedestrian fatality

Collision on Highway 2A causing fatality still under investigation.

Rachel Notley, leader of Alberta’s official Opposition, speaks in Edmonton on Wednesday, Oct. 16, 2019. Notley says the government needs to sharply ramp up the number of contact tracers if it wants to get a handle on the rising number of COVID-19 cases. THE CANADIAN PRESS/Jason Franson
Alberta Opposition calls for more COVID-19 contact tracers as case numbers rise

Alberta has about 800 tracers, and chief medical health officer Dr. Hinshaw says more are being recruited

Royal Alexandra Hospital front-line workers walk a picket line after walking off the job in a wildcat strike in Edmonton, on Monday, October 26, 2020. Hospital and health-care workers who staged a one-day illegal walkout returned to work Tuesday while politicians swapped recriminations and accusations in the house over the dispute. THE CANADIAN PRESS/Jason Franson
Alberta health staff return to work, surgeries resume after one-day walkout

AHS estimated 157 non-emergency surgeries, most of them in Edmonton, had to be postponed as a result of the walkout

Prime Minister Justin Trudeau makes his way to provide an update on the COVID pandemic in Ottawa on Tuesday, Oct. 27, 2020. Canada has reached a grim milestone in the COVID-19 pandemic, surpassing 10,000 novel coronavirus deaths. THE CANADIAN PRESS/Sean Kilpatrick
Alberta COVID deaths pushes Canada past milestone of 10,000 deaths

Canada crossed the threshold of 5,000 deaths on May 12, a little over two months after the first was reported

Most Read