Saanich has come a long way on privacy issues since municipal managers decided to install spyware software on the computer of Mayor Richard Atwell the day after he was sworn in on Dec. 1, 2014.

The municipality has made major strides in complying with provincial privacy laws, says a former B.C. privacy commissioner, and now “demonstrates a commitment to proactive, responsible privacy management,” David Loukidelis wrote in a 24-page report released Friday.

article continues below

His conclusion is in marked contrast to the scathing March 2015 report by current privacy commissioner Elizabeth Denham. She criticized Saanich for installing Spector 360, monitoring software that collects personal information entered at affected computers, without the authority to do so and for failing to notify employees whose personal information was being collected.

The use of the software only came to light when a former Saanich IT specialist heard about it and approached the mayor.

At the time, both Saanich council and management publicly expressed the mistaken belief that employees have no reasonable expectation of privacy on workplace computers, she wrote.

Saanich stopped using Spector 360 on Jan. 20, 2015, and deleted all information collected.

That was one of Denham’s five recommendations, several of which have been completed or are underway, Loukidelis wrote.

The municipality now employs a full-time privacy officer, Sheryl Masters, who was appointed at the end of January to audit Saanich and oversee the implementation of necessary policies.

Atwell noted he introduced a motion to council last April asking that such an officer be hired within 60 days, but it was defeated.

“It’s taken longer than I thought to get a privacy officer in place, but I’m glad that we have one now,” he said Friday.

“I would have liked it to happen a little bit more quickly. I think it would have shown that we were serious about fulfilling the recommendations of the privacy commissioner, but I think I’m satisfied with where we are.”

Atwell, who had a career in IT before running for mayor, said there are still not enough controls in place due to the municipality’s aging computer and technology infrastructure and the level of knowledge of its 1,400 staff members.

“It’s a process that’s going to take two years to completely educate the staff and to put systems in place that can provide all that the privacy commissioner is requiring and what all local governments need to provide,” he said.

“The challenge that the organization has is that it has to keep running. It can’t simply shut the doors and bring in brand-new computer systems that have a modern approach to information and private management and then open up shop again.

“The overall upgrade of Saanich’s computer systems to accommodate compliance with the legislation is going to take time, and that’s progress that the council is going to have to budget for and monitor, so that we modernize.”

Atwell said it might cost millions. Saanich has multiple computer systems that do different things and were introduced in different years, he said.

“That’s a challenge in itself. If you’re trying to implement a privacy regime, it has to be standardized, yet you’ve got all of these non-standard computer systems,” he said. Workplace computers have to deliver services, but the personal and municipal information they contain “needs to be kept from prying eyes, whether those are employees, customers, or hackers, or what have you,” he said.

“We have to find best practices, cost-effective approaches to doing this. We don’t want to reinvent the wheel. We want to do this in a way that is affordable and makes sense. We don’t want to put in a level of privacy that is excessive, but at the same time, we want to protect personal information and we want to protect financial information.”

Consultants will evaluate where Saanich is and where it needs to be, Atwell said.

CEO Paul Thorkelsson said privacy is a top priority for Saanich. “We are dedicating significant resources to these improvements,” he said in a statement.

Key municipal staff have already received privacy training, which is being expanded to all 1,400 full- and part-time staff members.

Senior Saanich staff met with Denham last week, briefing her on the progress and will keep on an “ongoing dialogue” with her office, the district said.

Atwell said he would like to put the Spector 360 issue behind him and the municipality and “essentially catch Saanich up with the modern privacy world.”

“I’m looking forward to some closure on this,” he said.

kdedyna@timescolonist.com