Privacy Breach

We are investigating a breach of information related to the Workers’ Compensation Appeals Tribunal decisions issued between 1996 and 2009. The breach included the posting of individual names together with personal health information. We take this seriously and are working to determine what happened. Maintaining privacy and confidentiality are of utmost importance to us.  For those who are concerned that their personal information may have been disclosed, please call 902-424-2250 .


Q.  How many records are affected?

It appears that 10,599 decisions were posted on the Canadian Legal Information Institute (CanLII) website including the name of the worker and the employer.


Q:  Are the decisions still on CanLII? 

The decisions were posted on CanLII on May 7 and 8, 2020. They were removed on May 12, 2020 after it was discovered that some private records may have been accessed.


Q:  Does the Tribunal know whose decisions were accessed? 

Working with CanLII we understand that 555 decisions with personal information had been accessed before being removed from CanLII. 


Q.  What are the Tribunal’s privacy protocols?

The Tribunal is following the provincial government’s privacy breach protocol. We contacted the Province’s Information and Privacy Review Officer and are focused on notification, containing the information involved and investigating the cause of the breach.


UPDATE:  The Tribunal has conducted a preliminary investigation.  The breach occurred when these pre-2010 decisions were transferred from a government-maintained public website to CanLII.  The old government website used software which was not maintained, or used by WCAT or Nova Scotia Digital Service and needed to be shut down.  The software filtered out the names of workers and employers in the published decisions.  It was the Tribunal’s intention that the data transferred to CanLII was to appear without names.  While there were safeguards in place for the transfer to protect privacy, these failed.  The Tribunal accepts that these safeguards were inadequate.  We are taking measures to ensure this will not happen again.