Victoria/Fraser Valley – A joint investigation by the information and privacy commissioners (IPC) of Ontario and B.C. has found that LifeLabs failed to protect the personal health information of millions of Canadians, resulting in a significant privacy breach in 2019.
Lifelabs have locations in Abbotsford and Chilliwack.
The joint investigation revealed that the company’s failure to implement reasonable safeguards to protect the personal health information of millions of Canadians violated Ontario’s health privacy law, the Personal Health Information Protection Act (PHIPA), and B.C.’s personal information protection law.
The Ontario and B.C. offices determined the company:
* failed to take reasonable steps to protect the personal health information in its electronic systems;
* failed to have adequate information technology security policies in place; and
* collected more personal health information than was reasonably necessary.
Both offices have ordered LifeLabs to implement a number of measures (summarized in the accompanying backgrounder) to address these shortcomings.
Publication of the report is being held up by LifeLabs’ claims that information it provided to the commissioners is privileged or otherwise confidential. The commissioners reject these claims. The Ontario IPC and B.C. OIPC intend to publish the report publicly, unless Lifelabs takes court action.
“Our investigation revealed that LifeLabs failed to take necessary precautions to adequately protect the personal health information of millions of Canadians, in violation of Ontario’s health privacy law,” said Brian Beamish, information and privacy commissioner of Ontario. “This breach should serve as a reminder to organizations, big and small, that they have a duty to be vigilant against these types of attacks. I look forward to providing the public, and particularly those who were affected by the breach, with the full details of our investigation.”
Michael McEvoy, information and privacy commissioner of British Columbia, said: “LifeLabs’ failure to properly protect the personal health information of British Columbians and Canadians is unacceptable. LifeLabs exposed British Columbians, along with millions of other Canadians, to potential identity theft, financial loss, and reputational harm. The orders made are aimed at making sure this doesn’t happen again.
“This investigation also reinforces the need for changes to B.C.’s laws that allow regulators to consider imposing financial penalties on companies that violate people’s privacy rights. This is the very kind of case where my office would have considered levying penalties.”
On March 25, 2020, the Ontario government amended Ontario’s health privacy law. Once implemented, Ontario will be the first province in Canada to give the information and privacy commissioner the power to levy monetary penalties against individuals and companies that contravene PHIPA.
FYI – Statement from the Office of the Information and Privacy Commissioner of Ontario and the Office of the Information and Privacy Commissioner for British Columbia on LifeLabs privacy breach: https://www.ipc.on.ca/newsrelease/statement-from-the-office-of-the-information-and-privacy-commissioner-of-ontario-and-the-office-of-the-information-and-privacy-commissioner-for-british-columbia-on-lifelabs-privacy-breach
