Government data security probed

Complaints commissioner John Epp will investigate whether government electronic storage devices and the information they contain are being properly disposed.

Announcing the Own Motion Investigation Wednesday, Mr. Epp said there was some evidence that information on devices such hard drives, CDs, DVDs and memory chips, is not being properly erased before disposal.

‘Government collects a great deal of information, some of which is sensitive to individuals, some of which is confidential and privileged, all the way through to matters affecting national security,’ Mr. Epp said in an interview Wednesday.

‘Because the consequences of wrongly releasing information through careless disposal are so grave, it is clearly in the public interest for me to investigate whether or not actual policies and procedures are in place to eliminate the risk.’

Responsibility for ensuring government agencies are properly disposing of electronic storage devices falls to the chief officers of the various government ministries and portfolios.

Mr. Epp informed chief officers of the probe 21 January, giving them one week to provide their policy on disposing electronic storage devices. If the policy has been to turn such devices over to government’s Computer Services Department, proof of that arrangement was requested. Where there was no policy in place, the Office of the Complaints Commissioner has asked for information on what was actually done.

Chief officers were asked to take steps to preserve any and all evidence that may relate to the topics under investigation, Mr. Epp explained.

‘Early responders have responded with policy documents, which is very encouraging,’ he said.

The first part of the investigation, establishing what policies were in place, is expected to take about one month. The OPP will then conduct interviews to determine whether government agencies are actually complying with their policies.

The potential outcomes of the probe could range from a public declaration confirming the good work of individual chief officers through to a finding of maladministration against individual chief officers and recommendations for improvement.

Ultimately, Mr. Epp hopes the investigation will lead to the introduction of a uniform standard for deleting data from government electronic storage devices and for disposing of those devices.

‘This investigation has been determined to be of special importance and in the public interest because of the obligation on government to properly safeguard sensitive information in its possession and the harm that might come to individuals and organisations if sensitive information was left unprotected when EDSCs leave the control of government,’ an OCC statement said.