Bureaucrats bungled privacy breach, review finds

The first reviews into a major privacy breach last year paint a picture of government bumbling that's so bizarre it's literally had to believe.
Imagine the police show up at your workplace and arrest an employee. That's what happened in the Ministry of Children and Families in Victoria last April 7.
They took him away and, armed with a search warrant, went through his house. The next day, the RCMP told the ministry they had found government files with names, addresses, social insurance numbers and other personal information in his house - everything needed for identity theft.
Anywhere I've worked, that would be a big deal. For sure, the bosses all the way up the chain would be told about it by the line managers.
Not in government. His bosses told him to stay home for a few days and then he was sick for a couple of weeks. His manager met with an HR person and talked about the kind of files found in his home. They never noticed, apparently, that the files were actually from the Housing Ministry, which the employee had transferred from 18 months earlier.
So they concluded he had just taken some work home. He was back on the job April 27.
They weren't the only ones to know about the investigation. The Finance Ministry risk management officers had been told in February. They never took the issue anywhere near senior management either.
That's baffling. Either those involved were incompetent, government bureaucracy is incredibly rigid or people have decided its best, for whatever reason, to keep the senior managers in the dark. Or they were hoping to cover up the problem. (The last assumption is supported by the fact that even though managers were advised to report the breach to the privacy commissioner in July, they didn't.)
Three weeks after the employee returned to work, his managers and the HR people got around to a meeting to talk about why police had arrested him.
The issue wasn't just about the files. The government had hired the man as Richard Ernest Wainwright. But the RCMP found had two drivers' licences, the other in the name of Richard Perran.
At the May meeting, he was asked about that. He wanted to distance himself from his past, Wainright said. But the stunningly incurious managers didn't ask him why. They didn't ask why he had the files at home. They seem, based on the review, quite useless.
By July, the managers knew more. As Perran, he had a criminal record from 2006 for fraud and identity theft.
Again, most managers might have considered that, those files and the RCMP investigation and, even if they didn't do anything, alerted more senior managers - probably the deputy minister, the top manager in the ministry.
But they didn't. Wainwright was a good employee so they decided to support him.
Finally, in August, an assistant deputy minister in the housing ministry was briefed on everything - the criminal record, the files, the fact there was no reason for him to have them. The ADM did nothing and didn't act on a recommendation that he notify the Ministry of Children and Families.
On Oct. 16, finally, the employee was suspended without pay.
On Oct. 20, Citizens Services Ben Stewart - and the Public Affairs Bureau - were notified. The employee was fired. So was his wife, who also had a sensitive job.
But the public wasn't told about any of this.
And it took until Dec. 4 - and a lot of pressure - before the government announced reviews of all this.
They found, unsurprisingly, that had been a big mess.
"The entire course of events is illustrative of a series of missed opportunities and inaction, related to gaps in information, mistaken assumptions, limited knowledge and insufficient awareness," the review found.
There were lots of meetings, but departments didn't share information, managers didn't seek answers to obvious questions and no one acted. No one would be fired, because no one did anything glaringly wrong, the government says.
Read the reviews on the citizens' services ministry website. You'll feel much more nervous about government's competence.
Footnote: These were internal reviews. A more useful report could come from the province's privacy commissioner. But that has been delayed, in part because the government hired commissioner David Loukidelis as deputy attorney general but failed to have a replacement acting commissioner in place immediately.