November 30, 2022
Daryl Croft, Branch Manager of Open City and Technology, today issued the following statement:
“Earlier today, I notified City staff that private employee information was found within documents that were a part of a
privacy breach that occurred within this organization. This is a regrettable situation, especially for anyone who may be affected by this.
In May 2021, Open City and Technology (OCT) discovered that City records were accessed by a former employee without authorization. This person uploaded those records onto their personal cloud storage account. We immediately reported the breach to the City’s Corporate Access and Privacy Office (Office of the City Clerk).
Given the size of the breach, the City hired an outside forensic IT consulting firm, which was able to access the cloud account and identify more than 157,000 records that could belong to the City. We have no reason to believe the records were shared beyond the employee, who is no longer employed by the City of Edmonton.
OCT immediately strengthened its processes and safeguards to reduce the possibility of something like this happening in the future.
The City’s Delegated FOIP Head also reported the breach to the Office of the Information Privacy Commissioner of Alberta.
The Corporate Access and Privacy Office – or CAP Office – has spent months reviewing records to identify employees whose personal information may have been compromised.
Due to the number of records, the CAP team has not been able to look at every record. We do know that private information of more than 5000 employees was identified in the months-long records review.
Some files included employee names and payroll numbers. Other files included performance management information, seniority lists and recall information for employees who were temporarily laid off.
I notified all City employees earlier today of this breach and the potential of some personal information being compromised.
We take the protection of personal information very seriously. The City has invited employees to contact the Office of the City Clerk if they have questions about their privacy, including whether their personal information was identified in the records the CAP Office reviewed, and a member of the CAP Office Team will follow up.”
