In response to a complaint from a Qualicum Beach resident, the Office of the Information and Privacy Commissioner of BC (OIPC) has determined that Heather Svensen, the Deputy Chief Administrative Officer and Corporate Administrator for the Town of Qualicum Beach, “disclosed personal information without authorization, contrary to section 33 of the Freedom of Information and Protection of Privacy Act [FIPPA].”
The complaint stems from an email sent by Ms. Svensen on February 12, 2021 to multiple recipients in which the personal email address of a Qualicum Beach resident was revealed, without permission, to other email recipients.
Svensen’s email was intended for representatives of selected media outlets. The OIPC investigator states that the “public body” (Town of Qualicum Beach) claims it was “unaware” that the email address was not a business email, and that “the disclosure of your personal email address was unintentional.” The OIPC stated “[Town] staff have been reminded of their obligations under FIPPA to protect personal email addresses.”
The Town has admitted that it “inadvertently” disclosed the complainant’s personal email address, “without authority to do so.”
A copy of the complaint to the OIPC is available below.
Town provides inaccurate response to Privacy Commissioner
In regards to Deputy CAO Heather Svensen’s unauthorized disclosure of personal information, the Town told the OIPC investigator that “communications staff were asked for the contact information of local media sources. Communications staff provided a list of e-mail addresses to Heather [Svensen] which included the email address for [the complainant].”
The intended recipients were members of the media, including Second Opinion QB. It does not seem plausible that staff could not determine the correct business contact email address, given that this contact information was readily available online. Instead, the staff apparently took time to scour Town databases to find and provide a personal email address for Ms. Svensen to use.
Further, the Town advised the OIPC investigator that “the [Town’s] IT department has removed [the recipient’s] email address completely from their system.” That is not accurate — this personal email address is still receiving emails from the Town of Qualicum Beach. However, these broadcast emails are not a concern because the recipient asked that their name be included in the distribution list and because individual email addresses are hidden from public view on these emails.
Personal email addresses of many QB residents have been disclosed by Town
Second Opinion QB has learned that this problem is more widespread than the single unauthorized disclosure of one personal email address.
The Town has, for the last several years, routinely disclosed the personal email addresses of many Qualicum Beach residents in the Town’s publicly-accessible Correspondence Log, including the personal email address of a minor, a young girl. Recently, it appears most personal email addresses in the Correspondence Log are being redacted, although not all.
Each of these pieces of correspondence are signed off by Ms. Svensen before being placed in the Log. While many of the email addresses have been redacted (blacked out), many have not. One QB resident who complained to Deputy CAO Heather Svensen about the public disclosure of personal email addresses was told that she did not have the time to redact the personal email addresses from each piece of correspondence.
This does not explain why the personal email addresses of some writers whose communications have been placed on the Town’s Correspondence Log were redacted while others were not, in clear violation of basic privacy principles and BC legislation.