UVic Commissioned Privacy Review Now Available

The University of Victoria today released the report of an external review it had commissioned on the privacy breach at the university earlier this year. The breach resulted from a break-in at the Administrative Services Building on the weekend of January 7-8 and the theft, from a safe, of a storage device containing payroll information.

The review was conducted by former BC information and privacy commissioner David Flaherty, an internationally recognized privacy expert, who examined how the university protects personal information across campus. UVic law professor and former Vice-President Academic Jamie Cassels was also asked to look at what led to the specific incident, to assess the steps the university has taken in response and to report his findings to Flaherty.

Flaherty’s report contains recommendations for strengthening privacy and security protection through measures including: improvements in training and education; widening of encryption practices; additional enforcement of existing standards and policies; and the development of campus-wide physical security standards. The report also recommends greater coordination of policies; clarification of roles and responsibilities; and a review of business continuity and disaster recovery plans on campus.

The report notes that UVic started making systemic changes immediately after the incident and is already acting on many of the recommendations.

Flaherty describes the university’s overall initial response as “exemplary” and suggests that by applying the lessons learned from its recent experience, UVic can “become a leader in North American higher education on privacy and security protection.”

UVic has accepted Flaherty’s report and is considering how best to implement the recommendations.

The university also responded to a report on the incident from the Office of the Information and Privacy Commissioner for BC in March, accepting its findings and recommendations. All of those recommendations have been implemented or are in process.

Flaherty’s report is available at www.uvic.ca/infobreach.
 

-- 30 --