Privacy complaint reveals 'simmering tension,' dysfunction at Nunavut's health department, commissioner says

Nunavut's information and privacy commissioner has determined that a manager in the territory's Department of Health breached an employee's privacy.

And while Commissioner Graham Steele said the breach itself was a lapse in judgment, he said his investigation also found a workplace culture of "tension," "alliances" and "dysfunction" at the department.

Steele released a report on April 24, describing a complaint from a government worker whose personal information had been shared by a manager to other Department of Health staff.

Steele said he couldn't reveal many details about the incident or where it happened, to avoid further compromising staff privacy.

In his report, Steele writes that the breach represented a lapse in judgment by the manager, who shared one employee's information with another employee. Steele said it was not a problem with government policies or procedures, and that the breach is best left to the department to resolve.

"I do worry, however, that I am being drawn unwillingly into a wider workplace dispute," he said in the report.

Decision on privacy won't solve larger workplace issues, commissioner says

Steele said the workplace seems to have "simmering tension" among employees, and between management and employees.

"No matter what I decide, it will not resolve the underlying workplace dysfunction. This decision may become just another source of tension," he wrote.

Steele recommended that senior managers at the Health department address the workplace tensions and remind managers about the appropriate means for airing workplace frustrations.

"That, more than anything else, is likely to reduce the risk of unauthorized disclosure to co-workers of an employee's personal information," he said.

In an email statement, the department's acting deputy minister Chris Nolan said that the manager involved in the privacy breach will be reminded of the importance of respecting privacy and confidentiality and will be directed to take privacy training. Nolan said that any decision to discipline is confidential.

Steele declined an interview with CBC News about his report, to maintain privacy of those involved.

In the commissioner's 2023-24 annual report, the Department of Health is listed as the public body most involved in information and privacy complaints or breach notifications.

In 2023, Steele recommended the territory prosecute a doctor who had improperly accessed a colleague's medical records. And in 2020, a health department employee looked at a complainant's records out of concern over an affair the complainant was having with the employee's spouse.

In an email, Steele said the Department of Health consistently has the largest number of notifications and complaints. He said since the department deals with such a large volume of patient information, it's almost inevitable it will have the highest number of breaches.

He also said he believes the Department of Health is more diligent than other departments about notifying the commissioner about privacy breaches.