LifeLabs report released after losing bid to remain silent

Article content

The long-delayed investigation into a 2019 hack at LifeLabs Inc. that compromised the health data of millions of Canadians has finally been made public after an Ontario court rejected the company’s appeal to block the release of that information.

Article content

Recommended Videos

A statement by Ontario and British Columbia’s privacy commissioners says their joint report, completed in June 2020, found that LifeLabs “failed to take reasonable steps” to protect customers’ data while collecting more personal health information than was “reasonably necessary.”

The report instructed LifeLabs to address a number of issues, such as properly staffing its security team, and the commissioners’ statement said the company complied with all orders and recommendations.

LifeLabs had cited litigation and attorney-client privilege to block the document’s release, but the commissioners’ offices opposed it.

Article content

Article content

The company then sought judicial review in the Ontario District Court before the case went to the Ontario Court of Appeal, where LifeLabs’ appeal was denied.

B.C.’s information and privacy commissioner, Michael Harvey, said in a statement that “the road to accountability and transparency” for victims of data breaches is “very long.”

“LifeLabs’ failure to implement adequate safeguards against this attack undermined patients’ trust, and the risk it exposed them to was unacceptable,” says Harvey. “When this happens, it is important to learn from past mistakes so others can prevent future violations.

“But to learn from the lessons, we need to share them.”

RECOMMENDED VIDEO

Article content

We apologize, but this video failed to load.

Play Video

Patricia Kosseim, Ontario’s information and privacy commissioner, said in a statement that she was pleased with the court’s decision to uphold her office’s decision “to help restore public confidence in oversight mechanisms designed to hold institutions accountable.”

In May, Canadians who applied to join the class-action lawsuit against LifeLabs began receiving checks and e-transfers; manager KPMG said more than 900,000 valid claims had been received.

An Ontario court has approved a nationwide settlement totaling up to $9.8 million related to a data breach that allowed hackers to access the personal information of up to 15 million customers.

Article content