B.C. steps in as local government struggles to get allegedly stolen files back from former IT manager

Thousands of copied internal files. Hundreds of documents with confidential information. A rogue IT manager accused of helping his son in a fight with his neighbour. A defeated local government asking the province to bring in its top legal minister.

These are elements of a drawn-out privacy-breach battle involving the largest municipality on Vancouver Island and one of its ex-employees, which recently escalated to the point where B.C.'s attorney general has become involved to try to fix the situation.

"This is an unusual matter," said Troy DeSouza, a lawyer who's specialized in local government litigation for more than 25 years.

"It's not too often that you get internal unauthorized information accesses like this and then, more importantly, a refusal to either acknowledge or delete the information."

The province filed a rare petition in B.C. Supreme Court last week asking for a court order to force Guy Gondor, the man accused of copying the internal files, to destroy them or give them back.

2,500+ files copied to personal drive, claim says

The petition claims the privacy breach started with Gondor, the former IT manager for the District of Saanich.

Gondor is accused of copying 2,580 internal files from a shared work drive to his personal drive on two occasions in December 2021 and January 2022.

Two months later, B.C.'s Office of the Information and Privacy Commissioner (OIPC) received two DVDs in the mail. They were loaded with district files — mostly to do with Saanich's engineering department. 

Court documents said the DVDs were shipped anonymously.

Some of the files concerned Gondor's son, Darian, who has for years been fighting with the district and his neighbours in a rural part of the municipality.

Darian Gondor has met resistance trying to turn his hilly Meadowbrook Ridge property into a hobby farm. Court documents said his neighbours have filed nearly 50 bylaw complaints against him, while he's filed nine against them.

The petition said Darian emailed the district to complain about his neighbour cutting down trees two days after OIPC staff received the DVDs.

In his email, Darian attached two documents as evidence his neighbour has broken rules. He said the files had "recently" come "into his possession," but didn't say how.

Saanich said the documents — a letter and a field report — had only ever been shared between district staff and the neighbour, and Darian never filed a freedom of information request to get them otherwise.

Suspecting a leak, the district hired an outside firm to investigate. The petition said KPMG found Guy Gondor's employee login was the one used to copy the files and burn them to the DVDs.

It is still not known who mailed the DVDs to OIPC.

None of the allegations in the petition have been proven in court.

Guy Gondor has not filed a response to the claim in court and did not respond to requests for comment from CBC News.

301 files with addresses, emails

Aside from containing information about Darian Gondor's neighbour, the petition said a portion of the copied files contained other people's personal information, including residential addresses, names, email addresses, phone numbers, internal employee ID numbers and some "personal views and opinions."

Saanich said it sent Guy Gondor two letters asking him to return or delete the files last year. Court documents include a brief letter Gondor sent in response on June 16.

"l am confused as to why you would be sending me these letters as my access credentials would not provide access to personal information. As you are aware, my unique user name ... did not have any privileges that would grant access to any personal information," the letter read.

"In addition, my user name did not have access to any corporate applications that would have access to the personal information of the Saanich residents.

"I am a strong advocate for protecting the privacy of citizen's data and would not access data outside of the scope and duties assigned to me by the District of Saanich."

District asks province to intervene

In July 2022, the district asked the attorney general for help getting the documents back — the first time the city has ever done so in a privacy breach case.

"Saanich is committed to protecting personal information and follows rigorous privacy and security processes in accordance with the Freedom of Information and Protection of Privacy Act (FIPPA)," the district said in a statement to CBC News.

"If a privacy breach occurs, Saanich takes immediate action to investigate, contain and secure the information."

Under FIPPA, B.C.'s attorney general has the authority to apply for court orders on behalf of a public body to force people to return or destroy private information if they aren't authorized to have it.

DeSouza, the lawyer, said the province has only won such an order once before.

In 2018, a former city councillor in Nanaimo was among three people ordered to delete copies of confidential city documents and related online posts after the attorney general filed a similar petition in B.C. Supreme Court.