Privacy commissioner smacks down Calgary police
The Office of the Information and Privacy Commissioner of Alberta kicked off Privacy Awareness Week (April 29 to May 5) by chastising the Calgary Police Service for its “exceptionally invasive” hacking of an employee’s personal email account.
The civilian employee was being investigated for inappropriate at-work behaviour by CPS’ human resources department following allegations from co-workers that she had bragged about sexual exploits with a CPS officer while at work.
According to the privacy commissioner’s report after stumbling across the login ID and password for the employee’s personal email the investigating IT security manager discovered photos sent through the email address which human resources said “would be very relevant to what they needed.”
The security manager testified the hacking turned up “self-taken topless pictures of [the employee] in a washroom stall…. It appeared these photos were taken on [CPS] property.”
The photos were used to terminate her employment but should not have been said adjudicator Amanda Swanek in the privacy commissioner report.
“The IT Manager seems to have been following protocol to find data leakage risks; however there is no indication that the Public Body had reason to suspect that the Complainant was leaking data” Swanek wrote. “Upon opening the photographs of the Complainant it must have been clear that they did not consist of leaked Public Body data. However the IT Manager viewed them long enough to recognize the tile work in the background of the photograph.”
Swanek decided the actions of the IT manager and human resources department was completely unjustified. The employee has since been reinstated and CPS was ordered to provide staff training “concerning the appropriate collection of personal information.”
