As Saanich council grapples with how to formally respond to a scathing report from B.C.’s privacy czar about the District’s improper use of employee monitoring software, at least two councillors believe no one should be fired for the District’s poor adherence to privacy laws.
“There is no indication of incompetence in my view,” said Coun. Vic Derman, referring to the District’s use of Spector 360, monitoring software that records keystrokes and other user information in real-time.
The invasive program was installed on computers used by Mayor Richard Atwell and several top-level bureaucrats at municipal hall on Dec. 2 and was disabled on Jan. 20.
The extent of information collected contravened the Freedom of Information and Protection of Privacy Act, according to a report released by B.C.’s privacy commissioner Elizabeth Denham on Monday.
“We had a section of our staff dealing with Freedom of Information issues primarily. Then we had our IT department, who were very concerned with security. Perhaps we didn’t have appropriate communication between the two. That’s a structural fix we need to address,” Derman said.
Denham’s report stated District staff showed a “deep lack of understanding” about privacy laws in approving the program, but Derman dismissed those remarks as “editorial comment.”
“I don’t think there was incompetence at all, nor is it the role of the privacy commissioner to judge that. That’s out of place in her report,” Derman said.
Derman did agree council had erred when it issued a Jan. 13 statement claiming employees had no reasonable expectation to privacy at the workplace.
“We do have a provision where we let people use computers during breaks for private use,” Derman said. “I had forgotten about that provision. That then changed the nature of how you should collect data.”
Coun. Vicki Sanders agreed with Derman that structural changes are needed but said the lack of adherence to privacy law was “simply a mistake.”
“We do have our legislative department, who are very up to date on privacy. But I do think when it came to installing the security software, that department wasn’t included. There was nothing untoward. ... It’s just an unfortunate thing that happened and we’re the poster child for many municipalities that have the same problem,” Sanders said.
Former IT staffer speaks out
Jon Woodland, who spent 16 years as an IT staffer at the District of Saanich and left in 2013, said the only reason to purchase a piece of software like Spector 360 is for targeted investigations.
“You don’t buy a system like that to protect a network, you buy it to investigate someone or their activities,” said Woodland, who is now IT manager at the Township of Esquimalt.
Woodland said he alerted Atwell in December after speaking to former colleagues who were worried the software “was being rushed in” despite a strong adherence in the past to the protection of privacy.
“Any of the colleagues I’ve talked to have been as shocked as I was the municipality would install this type of software,” Woodland said. “I had an obligation to bring this forward to Mayor (Atwell).”
Denham said her investigation concluded Director of Corporate Services Laura Ciarniello gave the explicit authorization to the District’s IT department to install and enable the invasive tools of Spector 360 on Dec. 2. Former CAO Paul Murray was on vacation leave at the time and left the District with a $468,000 payout several weeks later.
“The former CAO (Murray) was aware in broad-brush terms of the plan to implement employee monitoring software,” Denham told the News. “But the express authorization to implement employee monitoring software with the capacity of keystroke logging and screen shots came from the Director of Corporate Services.”
IT staff disabled Spector 360 on Jan. 20, after Denham announced her intention to investigate its use. Saanich Police Chief Bob Downie, with the assistance of former B.C. Police Complaint Commissioner and Victoria lawyer Dirk Ryneveld, concluded in December there had been no criminal wrongdoing with the installation and use of the software.
But Denham criticized that investigation in her report for failing to consider violations of provincial privacy laws.
Both Sanders and Derman said the are willing to support recommendations from Denham, which include destroying all personal information collected by Spector 360; an update to District privacy policies; implementing a comprehensive privacy management program, and completing an audit of the District’s compliance with the privacy act and the appointment of a privacy officer.
“I’m hoping the public understands there were some weaknesses in how we set things up, but we’re improving them and we’ll get down to doing the business of the municipality,” Derman said.
Council will discuss Denham’s report at a meeting on April 13 at municipal hall.
editor@saanichnews.com