Office of the Information and Privacy Commissioner
September 25, 2008Office of
the Information and Privacy Commissioner
Report P-2008-003 Released
The Information and Privacy Commissioner, Ed Ring, has
released his Report P-2008-003 under authority of the Access to
Information and Protection of Privacy Act. A summary of the Report
is included below.
To view the Report in its entirety, please go to
//www.oipc.gov.nl.ca/reports-privacy.htm
Report: P-2008-003
Report Date: September 17, 2008
Public Body: Eastern School District
Summary: On 2 April 2008 Eastern School District ("ESD") contacted this
Office to advise that three desktop computers had been stolen from an
elementary school. One of these computers was the school server.
Information on the server consisted of personal information including
the names, addresses, MCP numbers, contact and bussing information of 83
school children. The Commissioner was contacted by ESD and asked to
investigate. The Commissioner found that given the circumstances of this
case, reasonable security measures were in place prior to the theft, in
keeping with the obligations imposed by section 36 of the Access to
Information and Protection of Privacy Act (the "ATIPPA").
Section 39 of the ATIPPA had also not been breached, given the
difficulty associated with accessing the personal information, the speed
with which the thieves had been apprehended and the fact that the server
had been stripped. Since the theft, ESD has taken several steps to
increase security arrangements and the Commissioner was satisfied that
ESD had now implemented a multi-layered approach to protect personal
information stored on the server, in keeping with its duty under section
36 of the ATIPPA. The Commissioner made no recommendations.
