City breaches privacy in mass email to Hamilton voters | TheSpec.com
City ‘inadvertently’ shares personal information, breaches privacy in mass email to hundreds of Hamilton voters
Breach affected 450 residents registered to vote by mail; city has alerted the provincial privacy commissioner
Matthew Van Dongen
By Matthew Van DongenSpectator Reporter
Fri., Oct. 14, 2022timer4 min. read
The city says it inadvertently breached the privacy of 450 people by leaving personal email addresses visible in a mass update to Hamilton residents registered to vote by mail in the looming election.
Critics say it’s just the latest in a series of election snafus that have made voting a challenge for residents.
Upset residents started posting online Thursday night about the screw-up, which the city acknowledged is a breach of provincial privacy laws.
“The City of Hamilton shared my name, that of my wife, and our email address with hundreds of other mail-in voters,” said Hamilton resident Joseph Dubonnet on Twitter. “This type of breach of privacy should never happen again.”
The city said in a Friday statement it “regrets the error and any distress that this incident may cause” and vowed a review “to ensure staff are trained in the protection of personal information.” The city also alerted provincial information and privacy commissioner Patricia Kosseim.
A spokesperson for the commissioner’s office confirmed it had also logged two privacy complaints from citizens as of Friday afternoon and a review of the matter is “in progress.”
So why does it matter?
Kosseim blogged about email privacy breaches this year, calling them avoidable but “very common.” For example, the number of misdirected email disclosures of personal information in the health sector jumped from 430 in 2018 to more than 960 in 2020.
YOU MIGHT BE INTERESTED IN...
Hundreds of bikers pay tribute to Hamilton kids who died in off-road tragedy
HAMILTON REGION
Hundreds of bikers pay tribute to Hamilton kids who died in off-road tragedy
16 hrs ago
There goes the neighbourhood: Opposition to building Dundas home has Toronto couple ‘gobsmacked’
HAMILTON REGION
There goes the neighbourhood: Opposition to building Dundas home has Toronto couple ‘gobsmacked’
3 days ago
“Errors are part of human nature, and sending out an email with the wrong attachment or to the wrong recipients is probably not new to most of us,” Kosseim wrote. “But mishandled emails can ... expose (individuals) to significant risks such as identity theft, cyberattacks, discrimination and possibly social stigmatization.”
In an interview, city clerk Andrea Holland said Hamilton has an automated system for registering mail-in voters. But any “additional notifications” are done manually.
In this case, she said the city manually emailed out a special update in “batches” of a few hundred mail-in voters at a time to address issues that have spurred complaints or questions to the city’s election hotline.
Holland said the update was meant to have been emailed via BCC (blind carbon copy), which prevents recipients of a mass email from seeing anyone else on the list. Instead, one batch of around 450 mail-in voters received an email with email address information visible.
Holland said the city’s own privacy analyst is reviewing what went wrong and will report findings to the provincial commissioner’s office.
Dubonnet told The Spectator he filed privacy complaints with both the city clerk and the provincial commissioner — but added he had other concerns with the city’s introduction of mail-in voting.
The west-end resident previously asked the city to explain wording on the mail-in ballot that instructs the voter to “use the pen provided,” even though the mail-in package does not include a pen.
More than one voter has also complained about receiving mail-in ballot packages later than expected, raising concerns votes would not arrive in time to be counted. “This defeats the point of a mail-in ballot,” said Dubonnet via email. “I drove to Dundas to drop my votes (at a municipal service centre) to make sure they made it in time.”
Election candidates also expressed frustration with the accumulating problems.
Mayoral candidate Keanin Loomis issued a release noting would-be voters had reached out in frustration over the privacy breach, delayed mail-in ballots and “confusing and unclear” instructions. Ward 14 council candidate Brian Lewis circulated a complaint about problems with missing or inaccurate voter cards.
Holland said the city’s contracted mail-in voter vendor experienced a “slight delay” in getting packages to Canada Post, but added the delivery service confirmed all ballot packages should have been ready for delivery the week of Oct. 3.
“So we were quite surprised that there had been people who hadn’t received them yet,” she said. (If you are still waiting, or have yet to mail your ballot, they can be dropped off at a designated municipal service centre until Oct. 21 or you can vote at an advance or election-day poll instead.)
Holland confirmed the city is using the same ballot for both mail-in and in-person voting — thus the instructions about using “the pen provided.” Ironically, the email involved in the privacy breach was meant in part to clarify confusion over this language (you can use any black or blue pen or marker.)
The city will review all election processes and problems after voting day Oct. 24, Holland said. But she added the city is already looking at whether it can further automate correspondence with mail-in voters “to decrease the chance for human error.”
Breach affected 450 residents registered to vote by mail; city has alerted the provincial privacy commissioner
Matthew Van Dongen
By Matthew Van DongenSpectator Reporter
Fri., Oct. 14, 2022timer4 min. read
The city says it inadvertently breached the privacy of 450 people by leaving personal email addresses visible in a mass update to Hamilton residents registered to vote by mail in the looming election.
Critics say it’s just the latest in a series of election snafus that have made voting a challenge for residents.
Upset residents started posting online Thursday night about the screw-up, which the city acknowledged is a breach of provincial privacy laws.
“The City of Hamilton shared my name, that of my wife, and our email address with hundreds of other mail-in voters,” said Hamilton resident Joseph Dubonnet on Twitter. “This type of breach of privacy should never happen again.”
The city said in a Friday statement it “regrets the error and any distress that this incident may cause” and vowed a review “to ensure staff are trained in the protection of personal information.” The city also alerted provincial information and privacy commissioner Patricia Kosseim.
A spokesperson for the commissioner’s office confirmed it had also logged two privacy complaints from citizens as of Friday afternoon and a review of the matter is “in progress.”
So why does it matter?
Kosseim blogged about email privacy breaches this year, calling them avoidable but “very common.” For example, the number of misdirected email disclosures of personal information in the health sector jumped from 430 in 2018 to more than 960 in 2020.
YOU MIGHT BE INTERESTED IN...
Hundreds of bikers pay tribute to Hamilton kids who died in off-road tragedy
HAMILTON REGION
Hundreds of bikers pay tribute to Hamilton kids who died in off-road tragedy
16 hrs ago
There goes the neighbourhood: Opposition to building Dundas home has Toronto couple ‘gobsmacked’
HAMILTON REGION
There goes the neighbourhood: Opposition to building Dundas home has Toronto couple ‘gobsmacked’
3 days ago
“Errors are part of human nature, and sending out an email with the wrong attachment or to the wrong recipients is probably not new to most of us,” Kosseim wrote. “But mishandled emails can ... expose (individuals) to significant risks such as identity theft, cyberattacks, discrimination and possibly social stigmatization.”
In an interview, city clerk Andrea Holland said Hamilton has an automated system for registering mail-in voters. But any “additional notifications” are done manually.
In this case, she said the city manually emailed out a special update in “batches” of a few hundred mail-in voters at a time to address issues that have spurred complaints or questions to the city’s election hotline.
Holland said the update was meant to have been emailed via BCC (blind carbon copy), which prevents recipients of a mass email from seeing anyone else on the list. Instead, one batch of around 450 mail-in voters received an email with email address information visible.
Holland said the city’s own privacy analyst is reviewing what went wrong and will report findings to the provincial commissioner’s office.
Dubonnet told The Spectator he filed privacy complaints with both the city clerk and the provincial commissioner — but added he had other concerns with the city’s introduction of mail-in voting.
The west-end resident previously asked the city to explain wording on the mail-in ballot that instructs the voter to “use the pen provided,” even though the mail-in package does not include a pen.
More than one voter has also complained about receiving mail-in ballot packages later than expected, raising concerns votes would not arrive in time to be counted. “This defeats the point of a mail-in ballot,” said Dubonnet via email. “I drove to Dundas to drop my votes (at a municipal service centre) to make sure they made it in time.”
Election candidates also expressed frustration with the accumulating problems.
Mayoral candidate Keanin Loomis issued a release noting would-be voters had reached out in frustration over the privacy breach, delayed mail-in ballots and “confusing and unclear” instructions. Ward 14 council candidate Brian Lewis circulated a complaint about problems with missing or inaccurate voter cards.
Holland said the city’s contracted mail-in voter vendor experienced a “slight delay” in getting packages to Canada Post, but added the delivery service confirmed all ballot packages should have been ready for delivery the week of Oct. 3.
“So we were quite surprised that there had been people who hadn’t received them yet,” she said. (If you are still waiting, or have yet to mail your ballot, they can be dropped off at a designated municipal service centre until Oct. 21 or you can vote at an advance or election-day poll instead.)
Holland confirmed the city is using the same ballot for both mail-in and in-person voting — thus the instructions about using “the pen provided.” Ironically, the email involved in the privacy breach was meant in part to clarify confusion over this language (you can use any black or blue pen or marker.)
The city will review all election processes and problems after voting day Oct. 24, Holland said. But she added the city is already looking at whether it can further automate correspondence with mail-in voters “to decrease the chance for human error.”
