Workers Compensation Appeal Tribunal Privacy Breach

A recent privacy breach released private and personal information online from hundreds of Workers Compensation Appeal Tribunal (WCAT) decisions. When WCAT decisions are released, both employee and employer names are supposed to be removed to protect intimate personal information. A total of 10, 599 unredacted WCAT decisions spanning from 1996 to 2009 were posted by the Canadian Legal Information Institute (CanLII), onto their open-access website on May 7-8, 2020. Most of these decisions included the names of the individuals involved in the WCAT proceedings. This resulted in a privacy breach by linking full names with the personal information included in the decisions.

Personal information included in WCAT decisions can be either health-related or non-health related. Health-related personal information can include physical or mental health information, health history (including family member’s health history), health card numbers, health care payments, or health care eligibility. Non-health related personal information can include addresses, phone numbers, political beliefs or associations, sexual orientation, marital status, family status, education history, criminal history, or employment history.

The Nova Scotia government was informed of this privacy breach by the CBC on May 12, 2020 and has since removed the unredacted WCAT decisions from the open-source CanLii website; however, these decisions, including the personal information included therein, were accessible to the public prior to their removal and could have been downloaded onto individuals’ computers from the CanLii website.  A notice posted on the WCAT website on June 23rd indicates that 555 of the 10,599 unredacted decisions were accessed between May 7 – 12.

The Province of Nova Scotia has since reported the incident to the Privacy Review Officer and issued a statement regarding the WCAT privacy breach, but it is only mandatory for the government to contact individuals who have had their health-related personal information breached. This means that a breach of personal information not related to health does not require the government to notify the individual that their privacy was breached. The Privacy Commissioner has yet to open an investigation into the matter but have stated they would do so if they received a complaint from an affected individual. For the time being, they are monitoring the Tribunal’s investigation.

Wagners is currently investigating this privacy breach. If you were involved in a Workers Compensation Appeal Tribunal decision between 1996 and 2009, and are concerned that your privacy may have been breached, we invite you to contact Wagners at 902-425-7330, toll-free at 1-800-465-8794 or via email to [email protected].

Back to News & Insights