How to expose a privacy breach - responsibly

By Rob Russo
Ottawa Bureau Chief

There is no more proficient document hound in Canada than Dean Beeby, who works in our Parliamentary Bureau. For more than 30 years, Dean has been sniffing out stories that governments had hoped would stay forever buried. He does his sleuthing quietly and rarely oversells what he brings in.

So when Dean suggested he had a story that needed our urgent attention last week my news bunion began paining me instantly. The ache was accurate.

Dean had for months used a series of Access to Information and Privacy Online Requests (ATIPs) to track the Canada Revenue Agency's pursuit of charities. The taxman had given up a number of embarrassing secrets reluctantly, but the package that arrived from CRA last week had them pleading for its return before Dean had a chance to open the seal on the envelope.

The package contained a compact disc with names - several hundred of them - of prominent Canadians along with some confidential tax information about their attempts to win tax credits for donations made to various museums. The envelope had been sent to Dean inadvertently and its contents made it clear why CRA wanted it back. This was a staggering breach of privacy. Tax information from some of Canada's best known artists and political figures such as Margaret Atwood, Gilles Vigneault and Jean Chrtien should never have ended up in a reporter's mailbox.

The file had been assembled to respond to an access to information request, but that information would have been held back entirely or heavily censored before it ever was released to a reporter. This was unredacted, it was eye-popping and CRA was banging on the door looking to get it back. CBC opted not to give the package back which led to decisions on several other thorny questions.

Was it news? In an age when protections for personal privacy are as wispy as gossamer, a spill of this kind of personal information was disturbing and clearly met the threshold of news.

Should we name those whose privacy had been breached?

This was a tougher call. This was a story of an accidental leak of the tax information of prominent Canadians. We named some of those victimized by the leak in order to underscore the scope and scale of the breach and we sought to contact many of them. Identifying those whose personal tax information had been revealed did nothing that compromised their privacy and allowed some to tell us the impact this had on them. None of their tax information was made public. In many instances, the fact these celebrities had made these cultural donations was already a matter of previous public record. None of those contacted for our stories raised any objections to their names appearing in various CBC news items.

Were there other potential stories in the data we had been handed? This file contained very sensitive information about all of those named in it, but we chose to report the leak responsibly by laying blame for the breach at the hands of the CRA and avoid re-victimizing taxpayers who were the initial casualties of this error.