Investigators looking into the sale of 41 high-capacity tapescontaining 77,000 personal medical files at a government auction inBritish Columbia earlier this month have been able to ascertainthat it was not the B.C. Ministry of Employment and Investment’spolicy to sell tapes.
But Chris Norman, executive director in the CIO’s office inB.C., would not say if the incident represents a breach of policyrather than procedure. “That will be up to the investigation toascertain. But investigators have been able to ascertain that theMinistry had a specific policy not to sell computer tapes,” hesaid.
The government is conducting an investigation in cooperationwith the Office of the Information and Privacy Commissioner (OIPC)of B.C. “We expect to be able to report on that very soon, and thefindings will be made public,” said Norman.
The Ministry did allow the sale of computer hardware such asobsolete PCs in the past, he said, but a moratorium on the sale ofall computer equipment, including tapes, is in effect now pendingthe results of the investigation.
“For PCs, the practice had been to destroy the hard drive or anymemory capacity, and then to sell the “boxes,” said Norman, addingthat the province’s computer asset disposal policies and practicesare being subjected to a careful review.
Ross Armstrong, senior researcher at London-based Info-TechResearch Group., believes underfunding may have played a role inthe debacle. “Government IT budgets are strapped,” said Armstrong.”It is not an uncommon practice to sell used IT gear to maximizeits value – many organizations do this in many industries.”
But with privacy legislation such as PIPEDA in effect, thegovernment must lead by example in implementing proper proceduresfor safeguarding the sensitive personal information it collects onCanadians, he said. “When people who set laws are violating laws,there’s obviously a real loss of taxpayer confidence,” saidArmstrong.
It so happens the anonymous buyer of the tapes was honest inthis instance and turned them over to the Vancouver Sun when hediscovered they contained personal information. “But this raisesquestions about what else may be going on out there that we don’tknow about,” said Armstrong.
Each province sets its own best practices for tape disposal,said Gordon Smith, spokesperson for Ontario’s Ministry ofGovernment Services. “The government of Ontario has strong policiesand procedures for tape disposal. Tapes are never re-sold. They aredestroyed once they’re no longer needed for business or archivalpurposes,” he said.
Back-up tapes are typically retained for about five to 10 years,depending on the business requirements of the specific ministry, heexplained. “Tapes are typically destroyed by degassing,demagnetizing and shredding them, which are requirements from ouraudit side,” he said.
