Province sued over privacy breach involving 9,000 children

Hey there, time traveller!
This article was published 11/11/2021 (1450 days ago), so information in it may no longer be current.

A class-action lawsuit will proceed against the province after confidential information about nearly 9,000 children with disabilities was mistakenly sent to agencies that provide services to them and community advocates.

An email notice was delivered to potential claimants this week notifying them about the class action. Court records show a judge certified the lawsuit as a class action early last summer.

In August 2020, Children’s Disability Services staff accidentally sent an email intended for the Manitoba children’s advocate to about 100 agencies and advocacy groups.

“The breach demonstrated that the defendant had inadequate policies for the protection of sensitive information and was blatantly careless in protecting such information,” the lawsuit alleges. “The defendant’s response to the breach was equally inadequate as it failed to notify class members directly and refused to and continues to refuse to confirm details of the breach.”

Data included in the misdirected email was requested by the children’s advocate for a review into the delivery of children’s disability services in the province. The review came on the heels of stories about children struggling to access services or dying while awaiting appropriate services.

Manitoba Families, at the time, attributed the blunder to “human error.” In a statement of defence filed in June, the province said the children’s advocate was “entitled to compel the disclosure of the information” contained in the email and Children’s Disability Services was authorized under the Personal Health Information Act to disclose the requested information.

Many of the recipients of the email were under contract with the province to provide services to children with disabilities and “were accustomed to managing personal information… which was similar in nature,” says the statement of defence.

After learning about the mistake, the majority of the email recipients quickly complied with a request to delete the email, says the statement of defence.

An attachment in the email included identifying information “that would allow someone to find, track or use the identity of anyone in the class,” alleges the lawsuit, including the child’s name, address, date of birth, disability, and services they received.

While a spreadsheet containing the identifying information was password-protected, the password was also included in the email.

“Child Disability Services never explained to the class why the child-specific information of 9,000 children had to be delivered to any organization in spreadsheet format without any anonymization or encryption,” the lawsuit alleges.

“The defendant’s actions and inactions related to the privacy breach caused humiliation, and extreme distress and anguish about the potential future uses of class members’ most sensitive information,” the lawsuit alleges.

No trial date has been set.

dean.pritchard@freepress.mb.ca