N.S. privacy commissioner says persisting lack of government support a 'major disappointment'

Nova Scotia's privacy commissioner says the provincial government's continuing lack of support for her office is a "major disappointment."

Tricia Ralph made the comments in the Office of the Information and Privacy Commissioner's annual report, which was released on Thursday. The 28-page document cites insufficient staffing and a quickly growing backlog of open files, and says they have not seen any improvement when it comes to shoring up inadequate resourcing.

"An unsurprisingly major disappointment this year was that we did not receive the additional permanent staff we asked for and very much need," Ralph said in the report. "To be blunt, I am being conservative when I say that our ability to provide our mandated services is significantly hampered by our insufficient resourcing."

Though the office's backlog looked to be levelling off last year, the report said on March 31, 2024, it had 700 files, up from the 479 files on April 1, 2023.

"We have exceeded the limit of our ability to keep pace with utilization of our office. We have asked for more staff every year and have been denied each time," the report reads.

In fact, the lack of resources affected the office's initial plan for the report, which was intended to be longer and include more information about its work over the past year.

"It quickly became clear that it would be counterintuitive to spend even more time away from file work to express how much time is taken away from working on files," the report reads. "Who's got time for that?"

This isn't Ralph's first request for more staff. The 2023 annual report also referenced pressures that prevented her office from doing its job properly.

Most of the cases on file involve claims that "a public body has withheld information and the applicant believes that they are entitled to it," with some of those cases dating back to 2019, the report said.

The office's thin resources were particularly stretched by the MOVEit cybersecurity breach that was reported last summer. Due to the breach, the office received more than 100 privacy complaints and fielded around 700 calls. Very few of those calls, however, were people looking to file a complaint. Instead, most callers were looking to speak to the Nova Scotia government.

"The MOVEit cybersecurity breach resulted in 110 new privacy complaints in four months, compared to an average of 10 per year in past years. No additional resources were provided to our office to address the biggest privacy breach in the history of our province," the report noted.

The report also says the province's privacy and information laws are "outdated" and need an overhaul.

"The Freedom of Information and Protection of Privacy Act (FOIPOP) is 30 years old, and has not been substantively updated during that time, despite great advances in technology since 1994," Ralph wrote. 

"We need legislative change because our laws are not modern enough to adequately protect the access and privacy rights of Nova Scotians.… Now is the time to amend these laws."