Privacy Commissioner releases report on Facebook incident
© Rudy Norman
The social media web site Facebook is a great resource when looking up old high school friends, but according to the Office of the Privacy Commissioner, it’s not to be used by municipalities to communicate private information.
The Office of the Information and Privacy Commissioner has released a report concerning a municipality in the region and an alleged breach of privacy brought forward by two individuals that involves their personal information and Facebook.
According to the report, released in late September, the complaint was received in January of this year and filed collectively by two individuals regarding the Town of La Scie.
“The Complainants stated that their personal information had been sent to one of the Complainants by a Town employee via a private message on a social media website,” said the document.
That web site, it says, was Facebook, and the employee used their personal account to send the information to the complainants.
That action, the complainants alleged to the Office, was in violation of the Access to Information and Protection of Privacy Act.
“The Complainants alleged that their personal information was not adequately protected pursuant to section 36; was improperly used pursuant to section 38; and was improperly disclosed pursuant to section 39,” reads the report.
Privacy Commissioner, Ed Ring, says the information in question was financial in nature.
“Personal financial information was emailed to us via a Town of La Scie employee’s personal Facebook account,” the original complaint received on January 19 read.
That was a Thursday. The following Tuesday, the Privacy Commissioner’s office contacted the Town of La Scie to inquire into the policies they had regarding the protection of personal information.
The town responded nearly a week later, and confirmed that the people who lodged the complaint against the town were correct in alleging that a Town employee, via Facebook, in fact contacted them.
However, says the Privacy Office, the town also made it clear that in their opinion, the method used was not an improper use of personal information, and claimed the employee was “doing her job,” and that the contact was made using the “Inbox” of Facebook, where only the people with the Facebook password of who the communication is between can see it. The town also says they didn’t have a phone number for the people in question.
However the Privacy Commissioner reports that the town did in fact have other means of contacting the Complainants, such as their mailing address, but chose to use Facebook instead.
When it comes to the disclosure of information outside of those it was intended for, though, the Commissioner says there’s no evidence to support any such thing happened.
“There is no evidence that the information was disclosed to parties other than the Complainants. I am therefore satisfied that no disclosure contrary to the provisions of the ATIPPA has occurred,” he said.
Although, the case doesn’t stop there.
Since the town had other means of contacting the Complainants, it was determined that while a privacy breach didn’t occur, the information was in fact misused.
“I have therefore determined that there has been an improper use of personal information because the Town chose to use a less than secure means of sending the Complainants’ personal information when another more secure means was available,” said Privacy Commissioner, Ed Ring.
He went on to explain that even if Facebook was the only way of contacting, the information shared in the message shouldn’t have been shared, and a request for the complainants to contact the town office would have been sufficient.
Also, he contends, there was no way of confirming that the town employee was in fact sending the message to the person they intended, since they were basing it on a search of everyone on Facebook, and using just the name of the person in the search.
“It was disturbing and surprising to learn that a Town employee felt it was appropriate to use her own personal Facebook account to send personal information about private matters to citizens. Also, the Town’s lack of policies surrounding communications with its citizens is disconcerting,” explained Ring, further. “I feel the need to stress that the use of Facebook and other social media websites by public bodies for the purpose of communicating personal information is a practice this Office discourages.”
As for the recommendations of the report from the Commissioner, Ed Ring says that the town should consider undergoing Privacy Training for all employees, and educate itself on the proper use of social media in a municipal context.
In addition to that, they should develop and implement policies and procedures governing the use of social media, as well as insist that the employee remove from her personal Facebook account, all personal information of all citizens compiled in the course of conducting work on behalf of the town.