Citizens' data lost in system

by Russ Francis on September 14th, 2006 at 7:00 AM

1 of 1 2 of 1

A University of B.C. professor emeritus of computer science says it is unacceptable that the B.C. government has been unable to discover what happened to 31 computer tapes containing personal information on hundreds of thousands of B.C. residents.

Richard Rosenberg, who is also the president of the B.C. Freedom of Information and Privacy Association, says that citizens turn over a large amount of personal information to the government on the understanding that it will be properly handled.

“The assumption underlying all of it is that it's well taken care of, it's monitored, it's used for the necessary purposes, and the only people who get to use it or see it are involved for that purpose,” Rosenberg told the Georgia Straight.

“People's lives are affected by the information in social services. It's not acceptable that the government, in retrospect, cannot figure out what happened to such important information.”

According to a report of a forensic investigation, obtained under a Straight freedom-of-information request, missing are three tapes containing social insurance numbers, names, and addresses for as many as 250,000 British Columbians who received income assistance in 1991, 1993, and 1998.

Another 16 of the missing tapes include the names of patients, birth dates, prescription records, diagnoses, and claims made under the Medical Services Plan and PharmaCare, as well as details of Care Cards and home oxygen services from 1984 to 2000.

In all, 33 tapes were discovered missing only in August of last year. Their absence was never reported publicly. During the investigation by consultants KPMG, two of the missing tapes were found. They had been loaned out and not returned. It is unclear what happened to the remaining 31.

However, the report of KPMG's investigation, which finished last February 21 for the B.C. comptroller general's office, listed two of the “more likely” explanations. The first is that the still-missing tapes were sent in error for confidential destruction. The second is that they were lent out and not returned. “Less likely” or “unlikely” explanations are that the tapes were intentionally thrown out or destroyed, hidden or misplaced, mislabelled, or intentionally removed for their information value or for resale.

Labour and Citizens' Services Minister Olga Ilich told the Straight that the problems hark back to the NDP era, when the government contracted out storage of tapes to Telus, on July 12, 1998.

“Since then, we've taken a number of steps to improve the procedures and record-keeping, and there are a number of safeguards that are now in place,” Ilich said.

Ilich added that her ministry contacted the office of Information and Privacy Commissioner David Loukidelis, which told ministry staff that the government has done everything necessary to protect the records.

The report said that it was difficult to complete a full investigation because of the long period of time between when the tapes were last known to be accessed and the discovery that they were missing. “A large number of persons had access to the data centre during that time, which made it difficult to isolate who was involved,” the report noted.

It added that last year's labour dispute between Telus and its employees also limited the investigation: “A number of Telus personnel, who would normally have been interviewed, were unavailable due to an ongoing labour dispute.”

The report said that there has been a “significant turnover” of staff at the data centre since July 1998. At the time, there were 18 government staff who remained at the data centre as contractors. But by last August, only three of these remained. The data centre stores about 200,000 computer tapes at any one time, of which about 70,000 contain government data.

In trying to track down the missing tapes, data-centre staff searched above the false ceilings using a stepladder and flashlight and looked under the floor, among other places.

Telus spokesman Shawn Hall told the Straight that when Telus assumed operation of the tape-storage system eight years ago, it took over responsibility for “existing staff and processes that were in place.”

Telus has since strengthened the data's security, Hall said.

All of the auditors' recommendations were deleted from the Straight's copy of the report, along with more than a dozen entire pages, on the grounds that their release could harm the security of a computer system.