The organization behind B.C.’s anonymous crime reporting service is facing scrutiny over how it handled sensitive information after a privacy breach prompted an investigation by the province’s privacy watchdog. The Office of the Information and Privacy Commissioner for British Columbia (OIPC) is examining whether B.C. Crime Stoppers had sufficient protections in place to safeguard information collected from people submitting tips. The investigation will focus on the organization’s responsibility to keep personal information secure, an obligation that applies to private organizations and non-profits under B.C.’s Personal Information Protection Act. The law requires organizations to take reasonable precautions to prevent personal information from being accessed, used or shared without authorization. The level of protection expected depends on the sensitivity of the records and the potential consequences if they fall into the wrong hands. For people who contact Crime Stoppers, confidentiality is particularly important. The service is designed to allow members of the public to share information about criminal activity without putting themselves in the spotlight. The OIPC says anyone concerned they may have been affected does not need to submit an individual complaint for the office to look into the matter. The investigation is ongoing, and the commissioner’s office says it cannot discuss further details while the file remains active. What people can do to protect themselves While the investigation continues, the OIPC is encouraging anyone who suspects their personal information may have been compromised to take steps to reduce the risk of identity theft and financial fraud. That includes changing passwords, enabling multi-factor authentication and contacting financial institutions immediately if suspicious transactions or account activity appear. People should also consider contacting Equifax and TransUnion to request a credit alert or freeze. This can make it more difficult for someone to use stolen information to open accounts or obtain credit in another person’s name. If sensitive identification has been compromised, contacting the appropriate issuing agency is also important. This could include Service Canada for a social insurance number, ICBC for a driver’s licence or Health Insurance BC for a personal health number. The commissioner also recommends reporting suspected fraud to local police or the RCMP and the Canadian Anti-Fraud Centre. Anyone who believes an organization mishandled their personal information should first raise their concerns directly with that organization, explain the impact and outline what they would like done to resolve the issue. If the matter remains unresolved after 30 business days, they can take their complaint to the OIPC. The privacy commissioner has the authority to investigate potential privacy violations, although it cannot award compensation or damages. The office has also published guidance for organizations on preventing privacy breaches, responding when information is exposed and supporting people who may be at risk of identity theft. For individuals, the central message is to act quickly if there is reason to believe personal information has been compromised, rather than waiting for evidence of financial loss.
