According to the Office of the Saskatchewan Privacy Commissioner, privacy has been defined in a variety of ways, and is considered to involve several different dimensions. They include:

The procedures outlined below focus on the last dimension of privacy.

Information privacy is understood as the right of an individual to determine for him/herself when, how and to what extent he/she will share his/her ‘personal information.’

Personal information (PI) and personal health information (PHI) is defined by the applicable privacy law. Generally speaking, PI/PHI is information about an identifiable individual. Typically, this school division will not consider a breach of privacy to have occurred if the information involved is sufficiently de-identified, provided as statistics only, or as aggregate data.

A privacy breach happens when there is unauthorized collection, use or disclosure of PI or PHI. Such activity is ‘unauthorized’ if it occurs in contravention of FOIP, LA FOIP, or HIPA. Examples would include ‘water-cooler’ conversations about client PI of which a co-worker has no professional ‘need to know’, or a health care professional accessing a database to check a patient’s status when he or she has no professional need to know the information.

Privacy breaches most commonly occur when PI/PHI about patients, clients/customers or employees is stolen, lost, mistakenly or purposely used or disclosed without the requisite need to know. Examples include when a computer containing PI/PHI is stolen or when PI/PHI is mistakenly emailed or faxed to the wrong person.

Privacy breaches may be accidental or intentional; they may be a one-time occurrence or due to systemic inadequacies such as a faulty procedure or operational breakdown. Privacy breaches are often predictable and with proper foresight and planning can and should be avoided.

                                        Privacy Breach Guidelines

                                        Office of the Saskatchewan

                                        Information and Privacy Commissioner

Take immediate steps to contain the breach. These steps may include:

Once the breach has been contained, an Organization should conduct an internal investigation. This investigation should be conducted by the Privacy Officer, FOIP Coordinator or an individual designated by the head of the Organization to conduct the investigation (hereinafter Privacy Officer). It may be conducted on an informal or formal basis depending on the nature of the breach. A breach investigation should address the incident on a systemic basis.

An internal investigation should include the following elements:

The following are some questions to consider asking when conducting an internal investigation:

The findings of an internal investigation should be recorded in an Investigation Report and should include the following:

A standardized Incident Response Plan or Privacy Breach Protocol is currently under development.  An Incident Response Plan or Privacy Breach Protocol will include:

To determine what other steps are immediately necessary and assess the risks associated with the breach. Consider the following:

Is Personal Information (PI) or Personal Health Information (PHI) involved?

What is the cause and extent of the Breach?

How many are affected by the Breach?

What is the foreseeable harm resulting from the Breach?

The key consideration in deciding whether to notify affected individuals should be whether notification is necessary in order to avoid, mitigate or address harm to an individual whose PI/PHI has been inappropriately collected, used or disclosed. Review the risk assessment to determine whether or not notification is required; document any analysis and decisions.

As a school division, we collect, use or disclose PI/PHI and therefore we are responsible for notifying affected individuals.  

When a privacy breach occurs at a third party entity that has been contracted to maintain or process PI/PHI, the breach should be reported to the originating Organization, which has primary responsibility for notification.

Notifying Affected Individuals

As noted above, notification of affected individuals should occur if it is necessary to avoid, mitigate or address harm to them. Some considerations in determining whether to notify individuals affected by the breach include:

When and How to Notify

Steps the individual can take to further mitigate the risk of harm. Provide information about how individuals can protect themselves e.g. how to contact credit reporting agencies (to set up a credit watch), how to change a health services number or driver’s license number; Contact information of an individual within the Organization who can answer questions and provide further information; and

That individuals have a right to complain to the OIPC. Provide contact information.

Regardless of what our determinations are with respect to notifications, we should consider whether the following authorities or organizations should also be informed:

Government institutions and local authorities can also contact the Access and Privacy Branch of the Ministry of Justice and Attorney General, for advice in regard to responding to an incident.

Once the immediate steps are taken to mitigate the risks associated with the breach, the Privacy Officer will thoroughly investigate the cause of the breach. This will ultimately result in a plan to avoid future breaches. This may require an audit of physical, administrative and technical safeguards.  The plan will also include a process to ensure that the prevention plan has been fully implemented.

As a result of such evaluations, the Privacy Officer will develop, or improve as necessary, adequate long term safeguards against further breaches.  Said policies and safeguards will be reviewed and updated to reflect and implement the recommendations gleaned from the investigation. Policy review and updates will occur regularly, at least biannually, after that.