Canada: Court Orders Release of LifeLabs Data Breach Report
Following a 2019 hacking incident at LifeLabs Inc., which compromised the personal health data of up to 15M Canadians, a joint investigation by Ontario and British Columbia privacy commissioners finalized in 2020 has been published.
Facts
- Following a 2019 hacking incident at LifeLabs Inc., which compromised the personal health data of up to 15M Canadians, a joint investigation by Ontario and British Columbia privacy commissioners finalized in 2020 has been published, with the report concluding that LifeLabs failed to safeguard client information.[1]
- The report, which also found LifeLabs had collected more health information than necessary, was released after the Ontario Court of Appeal dismissed the company's appeal to have it kept hidden on the grounds of attorney-client privilege.[2][3]
- LifeLabs, which handles the majority of doctor-prescribed medical tests outside of hospitals in British Columbia (BC), has since abided by the report's mandatory actions, including the appropriate staffing of security teams.[3][4][5]
- An Ontario court previously approved a $9.8M settlement for millions of customers, with over 900K Canadians filing compensation claims. Their compensation checks began being sent out in May.[2]
- The BC Privacy Commissioner said it's "important to learn from past mistakes so others can prevent future breaches," while Ontario's commissioner added that the court's ruling will "help restore public trust" in "oversight mechanisms."[3]
Sources: [1]CBC, [2]National Post, [3]Vancouver Sun, [4]The Epoch Times and [5]Victoria Buzz
Narratives
- Pro-establishment narrative, as provided by Canadian Centre for Cyber Security. Canada faces rising data breaches driven by cybercrime and state-sponsored attacks, targeting personal, financial, and health data. As threat actors grow more sophisticated, the government has allocated $917.4M to addressing the issue, strengthened the Cyber Centre, and begun offering public guidance to enhance resilience. More companies must implement their own strict safeguards and share intelligence with the government.
- Establishment-critical narrative, as provided by Substack. While discussions about cyber threat protections are important, we should also discuss how these companies collect and sell our data as a business model. From fitness routines to sleep and menstrual cycle trackers, health tech companies profit from giving third parties access to our most intimate details. It's time that patients be allowed to take ownership of their personal details.
