Privacy commissioner finds 2 B.C. police departments improperly accessed critic's data

B.C.'s Office of the Information and Privacy Commissioner (OIPC) has found two police departments improperly accessed the personal information of a Victoria man who previously filed freedom-of-information requests with them.

Blogger Stephen Harrison, who regularly files FOI requests with the Victoria and Saanich police departments on Vancouver Island, uses the data for his personal website — which documents the behaviour of the police forces in their interactions with marginalized people.

After a number of such data requests, Harrison requested his own records from the two organizations.

He found out that three employees — one from the VicPD, and two from the SPD — had conducted police record searches in the Police Records Information Management Environment (PRIME) database immediately following his requests.

The privacy commissioner ruled that the employees were not authorized to access Harrison's information in that manner, contravening Section 30 of the Freedom of Information and Protection of Privacy Act (FOIPPA).

The OIPC ruling recommends both police departments conduct regular privacy training.

Harrison says it shows the need for more transparency and accountability when it comes to police dealings.

"It seems like a bit of a cavalier approach to people's personal information, in terms of why they looked me up," he told CBC News. "It was probably because … they didn't think they would probably ever be in trouble or anybody would scrutinize this.

"I think that would suggest or point to [the fact] this is probably happening elsewhere to other folks."

In the OIPC reports investigating both departments, the employees who searched for Harrison's name in the PRIME database "could not recall" the reason why they did so.

The office has previously found that police record checks using PRIME — which may include information about arrest warrants, an individual's mental health calls, and investigations that do not result in charges — can be too intrusive.

SPD says privacy training under development

Harrison filed the requests for his own information last year and went to the OIPC after initially complaining to both the VicPD and SPD over the records searches.

An investigator from the OIPC asked both departments if it was standard practice to conduct police records searches if an FOI request was not personal in nature. 

Both the Saanich and Victoria police departments said it was not standard practice. The investigator also said that if there was an authorized reason for the searches, the concerned officers likely would have recalled the reason years later.

"Reasonable security arrangements must be established to protect individuals' personal information from unauthorized access, collection, use, disclosure or disposal," says the report from the office, citing the FOIPPA. "Reasonable does not necessarily mean "perfect," however a very high level of rigour is expected."

The OIPC says that both departments addressed the matter with the employees who conducted the records searches.

Harrison said he would ask the police boards for the respective cities to conduct audits of their data policies after the ruling and said there should be greater accountability when it comes to police surveillance.

"Unless they're made to, I don't think the departments will make any change by themselves," he said.

In a statement, Const. Markus Anastasiades from the SPD said that the department respected the OIPC's decision, as well as the recommendation for more privacy training.

"This training is currently under development," he said. 

SPD officers will now have to click an additional button when accessing confidential databases, which acknowledges that they are authorized to access the information for a valid police purpose.

In a statement Wednesday, VicPD said it took steps to address the issue with the officer who had conducted the search, and it has notified the Office of the Police Complaints Commissioner of the unauthorized access.

VicPD also said the department conducted "updated and enhanced" training around privacy arrangements prior to the decision, which they say will continue regularly.

"It is clear in the OIPC decision that this is a circumstance where an individual failed to follow our privacy training and protocols," the statement read. "At this time, we do not see a need to introduce any further protocols, as we are addressing both the individual matter and overall awareness appropriately."