P.E.I. Workers Compensation Board reports 47 privacy breaches in 4 years

P.E.I.'s information and privacy commissioner is recommending changes to prevent breaches at the Workers Compensation Board after 47 breaches to personal privacy were reported in a four-year period.

Privacy Commissioner Karen Rose started investigating after a WCB client complained in 2010 some of his medical information was mailed to an unrelated third party. The mistake was attributed to human error.

The same complainant later reported that he received someone else's personal information from WCB, something the agency again attributed to human error.

During the four years Rose investigated, the Workers Compensation Board reported 47 breaches of privacy — an average of one per month.

While Rose found the board had taken steps to prevent privacy breaches, she concluded they didn't go far enough and found the agency wasn't meeting its legal obligations to protect personal information.

Rose made a dozen recommendations for improvement, including:

• Educating management and staff about best practices when collecting, using and disclosing personal information.
• Establishing a privacy breach advisory committee that will meet regularly to share best practices and analyze errors.
• Reporting to the privacy commissioner every six months for two years.

Rose also suggested the board apologize every time it notifies a worker their privacy has been breached. The agency did apologize in the case that sparked the investigation, although there's no set policy to do so.

In a written response to CBC News, the Workers Compensation Board said it's committed to the protection of privacy and will use the commissioner's recommendations to further enhance protection.