LifeLabs Failed to Protect Canadians’ Personal Information, Commissioners Find

Last week, privacy commissioners in British Columbia and Ontario released their findings that LifeLabs violated millions of Canadians’ privacy by failing to implement adequate safeguards to protect their personal health information.

LifeLabs, the largest laboratory testing company in Canada, was hit with a cyber attack in October 2019, which affected as many as 15 million Canadians. The information that was reportedly accessed during the LifeLabs data breach included customers’ names, addresses, email addresses, login and password information, birthdates, and health card numbers.

The privacy commissioners noted that LifeLabs failed to take reasonable steps to protect customers’ personal health information stored in its electronic systems, failed to implement adequate security policies, and that the company collected more personal health information from its customers than reasonably necessary.

Ontario Information and Privacy Commissioner Brian Beamish indicated that British Columbia and Ontario would like to release the report to the public, but LifeLabs has claimed that some important elements are confidential or subject to solicitor-client privilege.

“We strongly disagree,” Beamish said. “We have provided LifeLabs with detailed reasons why we reject their claim. Based on LifeLabs’s position throughout this investigation, we fully expect them to bring us to court to prevent us from publishing the report.”

Beamish also noted that the LifeLabs data breach should remind organizations about their “duty to be vigilant against these types of attacks.”

British Columbia’s Information and Privacy Commissioner Michael McEvoy agrees that LifeLabs should agree to make the report public soon.

“LifeLabs exposed British Columbians, along with millions of other Canadians, to potential identity theft, financial loss and reputational harm,” McEvoy said in a statement. 

“This investigation also reinforces the need for changes to B.C.’s laws that allow regulators to consider imposing financial penalties on companies that violate people’s privacy rights.”

British Columbia’s privacy commissioner currently does not have the power to impose financial penalties for violations of privacy. A review of the province’s Privacy Act is currently underway, and includes a proposal to give British Columbia’s privacy watchdog the power to impose such penalties.

Last week, LifeLabs issued a statement reassuring Canadians that it had taken steps to strengthen its information security systems. For example, the company said it has appointed a chief information security officer to head the security improvements, and that it would utilize stronger technology to detect potential cybercrime.

“From the beginning, LifeLabs has committed to being open and transparent and we will continue to follow these principles as we work together on a path forward,” the LifeLabs statement says.

“We made a commitment to our customers that we would learn and work hard to earn back their trust.”

After the LifeLabs data breach, The B.C. Ministry of Health reportedly renewed its contract with the company, but made important changes, including provisions that strengthen privacy considerations.

“So I think people can be confident that significant changes have been made when they go to LifeLabs,” B.C. Health Minister Adrian Dix said. He notes that he has not seen any indication that the stolen data was misused. However, he acknowledges that the LifeLabs data breach affected public confidence.

LifeLabs was hit with a massive data breach class action lawsuit in December, which accuses LifeLabs of negligence, breach of contract, and violations of privacy laws and consumer protection laws.

The LifeLabs data breach class action lawsuit alleges the medical laboratory company learned of the cyber attack in October 2019 but failed to notify the public about the massive data breach until December 2019, after LifeLabs had paid a ransom to the hackers.

More than a dozen LifeLabs data breach class action lawsuits have reportedly been filed throughout Canada.

Lawyer Peter Waldmann, who is representing clients in one of the LifeLabs class action lawsuits, says that the privacy commissioners’ findings strengthen their case.

“The investigation presumably will help us find out what happened, which is the only reason I would think they would not want to disclose it, because it’s embarrassing,” Waldmann said.

What do you think about the privacy commissioners’ findings in the LifeLabs data breach? Do you think the commissioners’ report should be released to the public? Tell us your thoughts in the comment section below! 

Read More Lawsuit & Settlement News:

Juul E-Cigarette Class Action Lawsuit Filed Over Company’s Marketing

Is JUUL Bad For You?

Long Term Disability Lawyer | Insurance Claim Denial Help

Canada Roundup Glyphosate Cancer Class Action Lawsuit Investigation