Give It Back! BC Court Orders Former Public Body Employee To Return Records In A Privacy Breach

On June 21, 2024, the British Columbia Supreme Court (the Court) in British Columbia (Attorney General) v. Gondor, 2024 BCSC 1077, ordered the return of electronic records containing personal information (the Identified Records) that belonged to a public body employer, the District of Saanich (the District), after finding that the District’s former employee (Gondor) made copies of the Identified Records and distributed them without authorization.

In March 2022, the District learned that the Office of the Information and Privacy Commissioner of British Columbia was anonymously sent two DVDs containing the Identified Records.  Separately, as part of a bylaw dispute between Gondor’s son and his neighbor, the District received an email from Gondor’s son that included documents with personal information from the Identified Records. The District alleged that Gondor copied the Identified Records during his employment onto his work laptop and a USB memory stick without lawful authority and in violation of British Columbia’s Freedom of Information and Protection of Privacy Act (FIPPA). Gondor denied the allegations.

Section 73.2 of FIPPA provides that where a court determines that personal information is in the possession of a person not authorized by law to possess the personal information and the public body is entitled to custody or control of that personal information, the court must order the personal information to be delivered to the head of the public body. Pursuant to section 73.2(2) of FIPPA, the Attorney General sued Gondor on the District’s behalf for an order requiring (i) the return of the Identified Records to the District; and (ii) Gondor to destroy any copies of the Identified Records in his possession.

Although the Court acknowledged that the Attorney General’s case is circumstantial and there is no direct evidence showing that Gondor retained and disseminated the Identified Records after he left his position with the District, a technical investigation showed that a person using Gondor’s username is the only person who copied the Identified Records in bulk to an external location. The Court concluded that the evidence establishes, on a balance of probabilities, that Gondor made and disseminated unauthorized copies of the Identified Records, and, accordingly, granted the order sought by the Attorney General.

Summary By: Anna Troshchynsky