Ontario and BC Information and Privacy Commissioners Find LifeLabs Failed to Implement Reasonable Safeguards in 2019 Privacy Breach

On June 25, 2020, the Office of the Information and Privacy Commissioner of Ontario (Ontario IPC) and the Office of the Information and Privacy Commissioner for British Columbia (BC OIPC) announced that their joint investigation into LifeLabs’ 2019 privacy breach found that LifeLabs failed to protect Canadians’ personal health information.

The Ontario and BC Offices found that the company failed to take reasonable steps to protect personal health information in its electronic systems, failed to have adequate information technology security policies in place, and collected more personal health information than was reasonably necessary. Both Offices have ordered LifeLabs to implement various measures to address these shortcomings.

Following the 2019 breach, LifeLabs filed a petition in British Columbia’s Supreme Court to prevent the BC OIPC from accessing a report written by cybersecurity firm CrowdStrike, as previously covered by the E-TIPS® Newsletter here.  LifeLabs now claims that the joint investigation report prepared by the Offices contains privileged and confidential information that was provided to the commissioners.  The Offices intend to publish the report, unless LifeLabs initiates court action.

Earlier this year, the Ontario government amended the province’s health privacy law.  Once implemented, Ontario will be the first province to give the Ontario IPC power to impose monetary penalties against individuals and companies that contravene such laws. The BC Commissioner, Michael McEvoy, stated that the investigation “also reinforces the need for changes to BC’s laws that allow regulators to consider imposing financial penalties on companies that violate people’s privacy rights.”

Summary By: Steffi Tran