Stop Snooping: Alberta Privacy Commissioner Finds Employee Snooping Results In Real Risk Of Harm

In a recent breach notification decision, the Alberta Privacy Commissioner found that a real risk of significant harm arose after four employees were found to have accessed account information of other employees and credit union members without an authorized purpose. This decision highlights the importance of clear privacy policies and practices for employees and that the risk of privacy breaches is not just from external bad actors – it can arise inside of an organization.

Background

The organization discovered this breach through their internal audit system shortly after the unauthorized accesses occurred. It involved sensitive personal information of employees and credit union members, including their social insurance number, banking information, and other sensitive employment information.