Investigators looking into the sale of 41 high-capacity tapes containing 77,000 personal medical files at a government auction in British Columbia earlier this month have been able to ascertain that it was not the B.C. Ministry of Employment and Investment’s policy to sell tapes.
But Chris Norman, executive director in the CIO’s office in B.C., would not say if the incident represents a breach of policy rather than procedure. “That will be up to the investigation to ascertain. But investigators have been able to ascertain that the Ministry had a specific policy not to sell computer tapes,” he said.
The government is conducting an investigation in cooperation with the Office of the Information and Privacy Commissioner (OIPC) of B.C. “We expect to be able to report on that very soon, and the findings will be made public,” said Norman.
The Ministry did allow the sale of computer hardware such as obsolete PCs in the past, he said, but a moratorium on the sale of all computer equipment, including tapes, is in effect now pending the results of the investigation.
“For PCs, the practice had been to destroy the hard drive or any memory capacity, and then to sell the “boxes,” said Norman, adding that the province’s computer asset disposal policies and practices are being subjected to a careful review.
Ross Armstrong, senior researcher at London-based Info-Tech Research Group., believes underfunding may have played a role in the debacle. “Government IT budgets are strapped,” said Armstrong. “It is not an uncommon practice to sell used IT gear to maximize its value – many organizations do this in many industries.”
But with privacy legislation such as PIPEDA in effect, the government must lead by example in implementing proper procedures for safeguarding the sensitive personal information it collects on Canadians, he said. “When people who set laws are violating laws, there’s obviously a real loss of taxpayer confidence,” said Armstrong.
It so happens the anonymous buyer of the tapes was honest in this instance and turned them over to the Vancouver Sun when he discovered they contained personal information. “But this raises questions about what else may be going on out there that we don’t know about,” said Armstrong.
Each province sets its own best practices for tape disposal, said Gordon Smith, spokesperson for Ontario’s Ministry of Government Services. “The government of Ontario has strong policies and procedures for tape disposal. Tapes are never re-sold. They are destroyed once they’re no longer needed for business or archival purposes,” he said.
Back-up tapes are typically retained for about five to 10 years, depending on the business requirements of the specific ministry, he explained. “Tapes are typically destroyed by degaussing, demagnetizing and shredding them, which are requirements from our audit side,” he said.
QuickLink 063980
