Saanich Mayor Proved Right About Spying

A newly released report from the BC’s Privacy Commissioner shows that the Saanich mayor’s claims that he was being spied on were not unfounded.

Richard Atwell, Mayor of Saanich. (Photo Credit: Facebook)

Mayor Richard Atwell alleged earlier in the year that the municipality was using software to spy on him, and Privacy Commissioner Elizabeth Denham independently decided to investigate the claims back in January. Released Monday, her report on the investigation declares that the District of Saanich is in fact violating employee privacy rights with their monitoring software.

"Public bodies have a responsibility to secure and protect their computers and networked systems against internal and external threats. However, they must also respect an employee's legal right to privacy," said Commissioner Denham.

Privacy Commissioner Elizabeth Denham. (Photo Credit: Office of the Information and Privacy Commissioner)

Her report recommends that the District disable key features of the employee monitoring software, such as keystroke logging, automated screen shots, and continuous tracking of computer program activity. She says that these particular features violate the privacy rights of employees and elected officials.

“When the District of Saanich implemented employee monitoring software, staff enabled tools that would collect sensitive personal information from employees including personal websites visited, online banking transactions, confidential correspondence, and private passwords or images,” said Denham.

"The district can only collect personal information that is directly related to and necessary for the protection of IT systems and infrastructure. An employee's every keystroke and email, or screen captures of computing activities at 30-second intervals clearly exceeds that purpose and is not authorized by privacy law."

In addition, the District of Saanich appears to have failed to give adequate notice to employees and elected officials about the amount and type of personal information collected. Though the District has written policies for the use of equipment and facilities that employees must read and sign, these policies don’t outline the personal information collected, as required by privacy law.

"One of the most disappointing findings in my investigation is the district's near-complete lack of awareness and understanding of the privacy provisions of B.C.'s Freedom of Information and Protection of Privacy Act,” said Denham. “The law has been in place for more than 20 years, yet the district appears to not understand its most basic privacy provisions."

The privacy commissioner has recommended that the District destroy all data collected by the software, Spector 360, and the District has agreed to comply. In total, she gave five recommendations for change, including the implementation of a comprehensive privacy management program and appointing a privacy officer for the district.

*Cover Photo Credit: Richard Atwell/Facebook*