Middlesex County is seeking guidance from Ontario’s privacy commissioner after more than 20 laptop computers and some 70 hard drives containing “personal information” were left behind when the Middlesex-London Health Unit (MLHU) vacated 50 King St. earlier this month.
A letter written by county clerk Kathleen Bunting asks the privacy commissioner what the county should do with computers left in the office the health unit rented from the county prior to their move to Citi Plaza.
The letter says computers containing “some personal information and potential personal health information” were left in the office.
County IT staff discovered the information as they began work to re-purpose the computers.
“Once it was determined that a Health Unit data breach had occurred, IT staff halted any additional review,” the letter says.
Health Unit responds
“These computers were in a locked vault, and when our movers came for our last pickup, they didn’t realize there were items inside the vault,” said Dr. Chris Mackie, the Middlesex-London medical officer of health.
He said the health unit has since asked the county to retrieve them.
Dr. Mackie said the health unit plans to investigate the issue. He said no public information has been released, and was told the computers had been wiped, prior to the move, using military-grade erasing.
“We’ll see what’s on them,” he said.
‘This is no small matter’
County Warden Cathy Berghardt-Jesson said the county is in a tricky position.
“The concern is that it’s not our information, and it’s not information that we would be responsible for,” she told CBC News. “So what do we do with it? That’s really the question.
“We’re just custodians, we’re just a landlord. It’s unfortunate the way this has played out. Because this was left over from a tenant, we have to deal with it.”
Asked why the county didn’t ask the health unit to collect the computers, Berghardt-Jesson said she wants to ensure they’re following privacy rules now that the “chain of possession” has, for now, left the computers with them.
“We have to be respectful of privacy laws and privacy legislation. This is no small matter,” she said.
The health unit’s decision to leave 50 King St. was contested by the county in court. Middlesex County collected more than $600,000 in annual rent from MLHU. Eventually, the Ontario Superior Court ruled in the health unit’s favour.
Berghardt-Jesson said how the county has dealt with the computers has nothing to do with the dispute over MLHU’s move to vacate 50 King St.
“These are completely non-related matters,” she said.
Berghardt-Jesson said it’s possible the privacy commissioner may instruct the county to return the laptops to the health unit.
“The safest bet is to bring in this third party and they can tell us what to do with them,” she said.