UVic-commissioned privacy review available

The University of Victoria has released the report of an external review commissioned by President David Turpin after a storage device containing employee payroll information was stolen in January. The review by David Flaherty, an internationally recognized privacy expert, examined how the university protects personal information across campus.

Flaherty’s recommendations for strengthening privacy and security protection include: improvements in training and education; widening of encryption practices; additional enforcement of existing standards and policies; and the development of campus-wide physical security standards. The report also recommends greater coordination of policies, clarification of roles and responsibilities, and a review of business continuity and disaster recovery plans on campus.

The report notes that UVic started making systemic changes immediately after the incident and is already acting on many of the recommendations.

Flaherty describes the university’s overall initial response as “exemplary” and suggests that by implementing the recommendations, UVic can “become a leader in North American higher education on privacy and security protection.”

UVic has accepted Flaherty’s report and is considering how best to implement the recommendations.

UVic law professor and former Vice-President Academic Jamie Cassels was also asked to look at what led to the specific incident, to assess the steps the university has taken in response, and to report his findings to Flaherty. Cassels’ assessment and recommendations are included in Flaherty’s report.

The report is available at www.uvic.ca/infobreach.