Privacy commissioners in B.C., Ontario order LifeLabs to improve security

Privacy commissioners in B.C., Ontario order LifeLabs to improve security

VICTORIA — One of Canada’s largest medical services companies failed to put in place reasonable safeguards to protect the personal health information of millions of Canadians, say the privacy commissioners in B.C. and Ontario.

LifeLabs revealed last November that hackers gained access to the personal information of up to 15 million customers, almost all in Ontario and B.C., and that the company paid a ransom to retrieve and secure the data.

The breach was determined to have affected millions of Canadians and the privacy commissioners announced their joint investigation in mid-December.

A statement released Thursday by the commissioners says the breach last year broke Ontario’s health privacy law and B.C.’s personal information protection law.

The joint investigation found LifeLabs collected more personal health information than was necessary, failed to protect that data in its electronic systems and relied on inadequate information technology security policies.

B.C.’s privacy commissioner and health minister say the investigation shows that provincial legislation should be changed to allow fines against companies that don’t protect personal information.

Michael McEvoy, the information and privacy commissioner of B.C., said the size of the breach was largest he has investigated.

“This the most significant privacy breach I’ve ever seen in British Columbia as privacy commissioner and I think that our office has seen in many years,” he said in an interview.

Both the Ontario and B.C. offices have ordered LifeLabs to address shortcomings through measures that include improving its security systems and creating written policies and practices regarding information technology security.

But McEvoy said the health care company has opposed the release of the commissioners’ report on the grounds it contained confidential and privileged information.

“LifeLabs said today, in a press release, that it’s been open and transparent from the outset of this matter and we hope that in the spirit of that openness and transparency, they will drop any objections they have to the full publication of our investigation report,” he said.

B.C. Health Minister Adrian Dix backed that call.

“Public interest lies in more information being provided to build public confidence, and that’s how you respond to these things,” he said. ”LifeLabs is a great company and a great partner but what this has shown is they, and all of us, have to do better.”

LifeLabs says it has accelerated its strategy to strengthen its information security systems, including appointing a chief information security officer to lead the improvements.

The company said it has also made efforts to improve its information security management program with an initial $50 million investment and has hired a third-party service to evaluate its response.

“What we have learned from last year’s cyberattack is that we must continually work to protect ourselves against cybercrime by making data protection and privacy central to everything we do,” LifeLabs said in a statement.

Dix, who hasn’t seen the privacy commissioner’s report, said the government made changes in its contract negotiations with LifeLabs after the data breach. Those include provisions that strengthen privacy considerations and offer a place to incorporate the recommendations from the joint investigation, he added.

McEvoy also called for his office to be given the ability to fine companies who breach privacy laws, which Dix said he supported.

Ontario commissioner Brian Beamish says the breach should serve as a reminder to organizations, big and small, that they have a duty to be vigilant.

“I look forward to providing the public, and particularly those who were affected by the breach, with the full details of our investigation,” Beamish said in a statement.

The privacy commissioners said they have given LifeLabs 14 days to take them to court to oppose the release of the report.

This report by the Canadian Press was first published June 25, 2020.

The Canadian Press

Business

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Alberta has 3,651 active cases of COVID-19. (File photo)
432 new COVID cases sets another record Friday

Central zone holds steady at 126 active cases

"We are looking seriously at the spread and determining what our next steps should be," says Alberta’s chief medical officer of health, Dr. Deena Hinshaw, as the daily number of COVID-19 cases continues to climb.
427 new COVID cases is highest in Alberta ever

Central zone has 126 active cases of COVID-19

COVID-19. (Image courtesy CDC)
Temporary COVID-19 testing sites coming to Wetaskiwin and Ponoka

The Wetaskiwin location will open Oct. 23, 2020 and the Ponoka location will open Oct. 29.

COVID-19. (Image courtesy CDC)
City and County of Wetaskiwin reporting active cases

Both the City of Wetaskiwin and County of Wetaskiwin have active cases.

Alberta chief medical officer of health Dr. Deena Hinshaw updates media on the Covid-19 situation in Edmonton on Friday March 20, 2020. nbsp;Alberta is reporting it's highest daily number of COVID-19 cases, with 364 new infections. THE CANADIAN PRESS/Jason Franson
Alberta confirmed 323 COVID-19 cases Tuesday

Central zone active cases at 145

B.C. Liberal leader Andrew Wilkinson, B.C. NDP leader John Horgan and B.C. Greens leader Sonia Furstenau. (Black Press Media)
VIDEO: One day until B.C. voters go to the polls in snap election defined by pandemic

NDP Leader John Horgan’s decision to call an election comes more than a year ahead of schedule and during a pandemic

This photo provided by Air Force Reserve shows a sky view of Hurricane Epsilon taken by Air Force Reserve hurricane hunter team over the Atlantic Ocean taken Wednesday, Oct. 21, 2020.   Epsilon’s maximum sustained winds have dropped slightly as it prepares to sideswipe Bermuda on a path over the Atlantic Ocean.  The National Hurricane Center says it should come close enough Thursday, Oct. 22, evening to merit a tropical storm warning for the island.  (Air Force Reserve via AP)
Hurricane Epsilon expected to remain offshore but will push waves at Atlantic Canada

Epsilon is not expected to have any real impact on land

A voter places her absentee ballot in the ballot box, Wednesday, Oct. 7, 2020, at Merrill Auditorium in Portland, Maine. THE CANADIAN PRESS/AP/Robert F. Bukaty
American voters living in Canada increasingly being counted in presidential race

The largest number of Canadian-based American voters cast their ballots in New York and California

A composite image of three photographs shows BC NDP Leader John Horgan, left, in Coquitlam, B.C., on Sept. 25, 2020; BC Green Party Leader Sonia Furstenau, centre, in Victoria on Sept. 24, 2020; and BC Liberal Party Leader Andrew Wilkinson Pitt Meadows, B.C., on Sept. 24, 2020. THE CANADIAN PRESS/Darryl Dyck, Chad Hipolito
British Columbia votes in snap election called during COVID-19 pandemic

NDP Leader John Horgan called the snap election one year before the fixed voting date

Nunavut's provincial flag flies on a flag pole in Ottawa, on Tuesday June 30, 2020. The annual report from Nunavut's representative for children and youth says "complacency and a lack of accountability" in the territory's public service means basic information about young people needing services isn’t tracked. THE CANADIAN PRESS/Adrian Wyld
Nunavut’s young people ‘should be expecting more’ from government services: advocate

‘The majority of information we requested is not tracked or was not provided by departments’

Ryen Williams, 11, with a lost miniature horse at JJ Collett Oct. 23. Photo by Don Williams
UPDATE: Owners found

Father and son found him while out for a walk at JJ Collett

A Le Chateau retail store is shown in Montreal on Wednesday July 13, 2016. Le Chateau Inc. says it is seeking court protection from creditors under the Companies’ Creditors Arrangement Act to allow it to liquidate its assets and wind down its operations.THE CANADIAN PRESS/Ryan Remiorz
Clothing retailer Le Chateau plans to close its doors, files for CCAA protection

Le Chateau said it intends to remain fully operational as it liquidates its 123 stores

U.S. border officers at the Peace Arch crossing arrested two men on California warrants this week. (File photo)
Ottawa predicts system delays, backlogs unless court extends life of refugee pact

Canada and the United States recognize each other as safe places to seek protection

Conservative member of Parliament Michelle Rempel Garner, left to right, Conservative Leader Erin O’Toole and Conservative Deputy Leader Candice Bergen arrive to hold a press conference in Ottawa on Thursday, Oct. 22, 2020. THE CANADIAN PRESS/Sean Kilpatrick
No-confidence showdown over sweeping Tory motion on government handling of pandemic

The Conservative motion is to be put to a vote Monday and has the support of both the Bloc Québécois and NDP

Most Read