LONDON, ONT. -- Middlesex County officials have sent a letter to the Information and Privacy Commissioner of Ontario about data discovered on the hard drives of computers abandoned by the Middlesex-London Health Unit (MLHU).
Obtained by CTV News, the letter explains that the county’s IT department was examining computers for possible repurposing when they discovered “many of the hard drives contained health unit-related personal information and potential personal health information of individuals.”
Adding, “Once it was determined that a health unit data breach had occurred, IT staff halted any additional review.”
The computers are among a hoard of electronics abandoned by the MLHU when it moved out of the office building at 50 King St. it rented from Middlesex County.
Last week, Medical Officer of Health Dr. Chris Mackie told CTV News, “All of the equipment would have been cleaned for any health information or personal information.”
On Friday, Mackie elaborated, “Our hard drive erasing process uses DBAN technology. It’s military grade erasing. As far as I have been told by our corporate services team, all of that equipment was properly erased.”
In its letter, the county seeks guidance from the province’s privacy commissioner. Specifically, if the device should be returned to the health unit for proper disposal and the impacted individuals notified.
“Everybody should have concern about that. All we are doing is asking for direction,” explains Middlesex County Warden Cathy Burghardt-Jesson. “This is potentially personal health information and we are not set up to deal with that.”
The Office of Ontario’s Information and Privacy Commissioner tells CTV News, “While there is no particular required method to dispose of electronic media, it must be destroyed in such a way that the information cannot be reconstructed, or retrieved, and individuals cannot be identified.”
When asked by CTV News why the computers were not physically destroyed, Mackie explains, “Every intention was to process the equipment properly. The issue was that the place where the equipment was stored was in a vault. The door happened to be closed when our movers were moving out the last of the equipment.”
Burghardt-Jesson says contacting the privacy commissioner will ensure proper protocols are followed if the equipment is to be returned.
“We don’t want to be responsible for it, but by handing it back, is that appropriate?”
CTV News was not granted access to the digital information, and therefore can not independently determine the type of information nor the quantity.
Mackie says the health unit is also unaware of the specific information in question.
“We have reached out. As soon as that equipment was identified as being left behind, to try and bring that equipment back to the health unit so we can properly deal with it.”
He emphasizes that the move to Citi Plaza was impacted by the coinciding start of the COVID-19 pandemic.
“Things did happen in a rush and we’re very sorry that any equipment was left behind.”
