Diane McLeod-McKay, the territory’s information and privacy commissioner, says “highly sensitive” personal information belonging to thousands of Yukon government employees was being widely circulated to more than a dozen departments and the legislative assembly. (Crystal Schick/Yukon News file)

Personal data from thousands of Yukon government employees was accessible to too many people: report

Yukon Information and Privacy Commissioner says the government broken access to information laws

“Highly sensitive” personal information belonging to thousands of Yukon government employees has been widely circulated to over a dozen departments and the legislative assembly, a breach of the territory’s information and privacy legislation, according to an investigative report by the Yukon Information and Privacy Commissioner.

The Public Service Commission (PSC) isn’t authorized to do this, Commissioner Diane McLeod-McKay told the News when the report was released on Jan. 29.

“All employees of the Yukon government and potentially more than that” were impacted by the wholesale exchange of personal data, she said. “The information system itself was being used to process the personal information of all employees.”

That same data, collected at the point of hire and onwards until termination or retirement, was deemed to be insecure.

The report was spurred by a complaint lodged in November 2016 that alleged similar concerns.

Using an electronic human resources tool, PSC distributed details including “biographical information” and job titles to different HR branches belonging to 16 other departments and the legislature, the report says.

“Employees’ names, addresses, telephone numbers, identifying numbers, ages, sex, marital status, family status and information about their educational, financial and employment history is the identifiable information at issue,” it says.

“A short assessment of (the HR management system) security, using publicly available information and scenario-based modeling, recently resulted in the detection of a security risk to the overall system.”

Certain particulars of the report have been redacted for privacy reasons.

“Some departmental human resource professionals across government previously had access to personal information of employees not in their own department,” said Nigel Allan, a PSC spokesperson, in a written statement.

“Access by human resource personnel to employee information is now restricted to employees in their own departments. In addition, any sharing of employee information between departments is now limited to the Public Service Commission for general human resource management purposes and the Department of Finance for payroll purposes.”

Asked if this data was obtained by anyone outside the Yukon government, McLeod-McKay said “We have no indication that there has been any harm caused as a result of (the breach),” adding that making such a finding hinges on PSC conducting evaluations of its system.

Managers with proper clearances had access to personal information, the report says.

“For example, any manager who has such a designation could access the (private information) of any employee in (HR management system) outside the scope of that manager’s public body despite having no reasonable and direct connection to it, nor any necessity to use it,” it says.

The bottom-line is that data was available to people who simply shouldn’t have had access to it, McLeod-McKay said.

“Every government department had access to information to all the employees in the system,” she said. “We determined, in the report, that they did not have authority to do that.”

Personal information must be exclusive to the department in which an employee works, the report says.

Human resources “elsewhere have no function in the collection of (personal information) as it affects employees working in other public bodies.”

Personal data provided to the Department of Finance is authorized because these details are required to process salaries, bonuses and benefits.

The PSC is only able to disclose personal data “if it’s use is consistent with the purpose for which it was obtained or compiled,” according to the report.

There are certain restrictions. The financial branch, for instance, is not privy to biographical information, the report says, attributing it to a statement from the PSC.

“… I am satisfied that the collection of employee (personal information) to provide compensation and superannuation benefits to that employee is a key component of the administrative activity,” it says.

“(Personal information) must be limited to authorized persons whose responsibilities require such access, as opposed to their status, rank or office, or on a premise of practical or functional convenience.”

The report outlines 17 recommendations for the PSC to implement, which include containing the breach, revoking access that “designated employees” have to private information belonging to all government workers, excluding those who are retired, and bringing in prevention measures to ensure such incidents don’t occur again.

“The Public Service Commission has accepted them and we are working actually with them on doing a privacy impact assessment on their (human resources system), which essentially means we walk through the entire system … and find their authorities to collect these and disclose, as well as look at their security parameters to make sure they’re sufficient enough to secure the information appropriately, appropriately in accordance with the act,” McLeod-McKay said.

“Laws are there to protect citizens, which all of us are, so it’s really important, especially in this day in age of cybercrime and other kinds of leaks of information, that these steps now be taken to ensure that the information is properly secured.”

Allan, the PSC spokesperson, said most of the recommendations will likely be implemented by April.

Contact Julien Gignac at julien.gignac@yukon-news.com

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

d
Wyatt’s World

Wyatt’s World for March 5, 2021.

City councillor Samson Hartland in Whitehorse on Dec. 3, 2018. Hartland has announced his plans to run for mayor in the Oct. 21 municipal election. (Crystal Schick/Yukon News file)
Councillor sets sights on mayor’s chair

Hartland declares election plans

Whitehorse RCMP will provide internet safety training due to an uptick of child luring offences. (iStock photo)
RCMP hosting internet safety webinars for parents and caregivers

The webinars will take place on March 23 and 25

Premier Sandy Silver speaks to media after delivering the budget in the legislature in Whitehorse on March 4. (Haley Ritchie/Yukon News)
Territorial budget predicts deficit of $12.7 million, reduced pandemic spending in 2021-2022

If recovery goes well, the territory could end up with a very small surplus.

Dawson City RCMP are reporting a break and enter on Feb. 25 after two masked men entered a residence, assaulted a man inside with a weapon and departed. (Black Press file)
Two men arrested after Dawson City home invasion

Dawson City RCMP are reporting a break and enter on Feb. 25.… Continue reading

Chief Medical Officer of Health Dr. Brendan Hanley receives his first dose of the COVID-19 vaccine from Public Health Nurse Angie Bartelen at the Yukon Convention Centre Clinic in Whitehorse on March 3. (Crystal Schick/Yukon News)
State of emergency extended for another 90 days

“Now we’re in a situation where we see the finish line.”

The Yukon government says it is working towards finding a solution for Dawson area miners who may be impacted by City of Dawson plans and regulations. (Joel Krahn/Yukon News file)
Miner expresses frustration over town plan

Designation of claims changed to future planning

Team Yukon athletes wave flags at the 2012 Arctic Winter Games opening ceremony in Whitehorse. The 2022 event in Wood Buffalo, Alta., has been postponed indefinitely. (Justin Kennedy/Yukon News file)
2022 Arctic Winter Games postponed indefinitely

Wood Buffalo, Alta., Host Society committed to rescheduling at a later date

Crews work to clear the South Klondike Highway after an avalanche earlier this week. (Submitted)
South Klondike Highway remains closed due to avalanches

Yukon Avalanche Association recommending backcountry recreators remain vigilant

RCMP Online Crime Reporting website in Whitehorse on March 5. (Haley Ritchie/Yukon News)
Whitehorse RCMP launch online crime reporting

Both a website and Whitehorse RCMP app are now available

A man walks passed the polling place sign at city hall in Whitehorse on Oct. 18, 2018. The City of Whitehorse is preparing for a pandemic-era election this October with a number of measures proposed to address COVID-19 restrictions. (Crystal Schick/Yukon News file)
City gets set for Oct. 21 municipal election

Elections procedures bylaw comes forward

A rendering of the Normandy Manor seniors housing facility. (Photo courtesy KBC Developments)
Work on seniors housing project moves forward

Funding announced for Normandy Manor

Tom Ullyett, pictured, is the first Yukoner to receive the Louis St-Laurent Award of Excellence from the Canadian Bar Association for his work as a community builder and mentor in the territory. (Gabrielle Plonka/Yukon News)
Tom Ullyett wins lifetime achievement award from the Canadian Bar Association

Ullyett has worked in the Yukon’s justice ecosystem for 36 years as a public sector lawyer and mentor

Most Read