Saanich police ordered to stop privacy breach after officer used file information for gossip

Saanich Police Department breached British Columbia’s privacy law when an officer used information from a complainant’s police file for gossip, the province’s information and privacy commissioner’s office has ruled. The decision also found that the department’s safeguards and response to the complaint fell short of its legal obligations.

In Saanich Police Department, Order F26-65, 2026 BCIPC 80, adjudicator Rene Kimmett ordered the department on July 22, 2026, to stop using and disclosing the complainant’s personal information contrary to the Freedom of Information and Protection of Privacy Act. Recommendations for better training, policies and disciplinary guidelines accompanied that binding order; they were not themselves disciplinary penalties or an award of damages.

The central distinction was between permission to access information for an investigation and permission to use it afterward. Kimmett accepted that the officer was authorized to access the file for police work. That authorization did not permit personal conversations about the file with friends and family.

Evidence and responsibility

The complainant first raised privacy concerns with the department, which did not respond. An investigation by the commissioner’s office did not resolve the matter, and it proceeded to an inquiry. The officer was invited to participate but declined to make a submission because of concerns about prejudice to disciplinary proceedings described in the reasons. The decision does not establish the current status or outcome of those separate proceedings.

The complainant supplied screenshots of messages as part of affidavit evidence. The department questioned whether their authenticity, accuracy, completeness and context could be independently verified. Kimmett found no evidence that the messages were altered, inaccurate or taken out of context, and accepted them as an accurate record of messages the officer had sent.

Responsibility for proving compliance mattered to that assessment. Section 57 of FIPPA assigns the burden of proof in some inquiries, but does not expressly allocate it for the issues in this case. Drawing on earlier orders, Kimmett held that the department bore the burden under sections 30, 32 and 33. A public body has the knowledge, resources and expertise to explain whether a use or disclosure occurred and, if so, what authorized it.

The department also argued that the messages did not establish disclosure of identifying information and that the complainant had not supplied affidavits from the people said to have received it. Kimmett rejected that approach to the burden of proof. Obtaining such affidavits would have presented practical difficulties, including requiring the complainant to identify herself to the recipients as the person discussed.

A further departmental argument was that the officer wanted a personal relationship with the complainant kept private and therefore had an interest in not identifying her. Kimmett distinguished secrecy about that relationship from the earlier sharing of information about the police file. On the evidence, detailed and continuing updates made identification more likely. The department had not investigated the complaint and lacked sufficient evidence to support its position that no disclosure had occurred.

Authorized access was not authorized use

Section 32 limits the use of personal information in a public body’s custody or control. It permits use for the original purpose or a consistent purpose, use with the prescribed consent, or use for a purpose for which section 33 permits disclosure to the public body. For a use to be consistent with the original purpose, section 34 requires a reasonable and direct connection to it, as well as necessity for the public body’s statutory duties, program or activity.

The information had been obtained to investigate criminal allegations. Kimmett found no reasonable and direct connection between that purpose and giving personal acquaintances updates for gossip. The complainant had not consented to that use, and neither the department nor the adjudicator identified a basis for it under the remaining section 32 exception.

Disclosure raised a related but distinct question: was the information shared reasonably capable of identifying the complainant, either on its own or with other available information? Information does not lose its protected character merely because it is communicated verbally, where it exists or previously existed in recorded form. Kimmett found, on a balance of probabilities, that the shared information was capable of identifying the complainant. The department offered no argument that section 33 authorized the disclosure.

Safeguards must address more than database access

Section 30 requires reasonable security arrangements against unauthorized access, collection, use, disclosure or disposal. The department said new officers received mandatory access and privacy training, supplemented by periodic reminders. But it supplied no details about their content. Kimmett was concerned that its submissions confused lawful access with lawful use, revealing a misunderstanding of the separate obligations.

The department’s database-access policy prohibited access or use for personal reasons or gain and required a legitimate work purpose. Nevertheless, the adjudicator identified important omissions: it did not explain that discussing work information in one’s personal life could be unauthorized use or disclosure, or state that violations of privacy policies would result in discipline. The department also did not say whether staff had to sign confidentiality agreements.

A computer acknowledgement requiring a valid policing purpose for access served a useful function, but did not protect against subsequent misuse or disclosure. The breach policy also lacked FIPPA’s definition of a privacy breach and its updated notification and reporting requirements. It addressed confirmed breaches without explaining how staff should respond to suspected or alleged ones.

Kimmett assessed the response to the complaint through four elements of breach management: containment, risk assessment, notification where appropriate or required, and prevention. Those steps include investigating what happened, assessing the possible harm and deciding whether safeguards need improvement. They are not satisfied simply by preserving records for another oversight process.

The department maintained that no breach occurred or, alternatively, that it had complied with its policy by notifying the Office of the Police Complaint Commissioner, preserving relevant records and deferring to independent oversight. Kimmett found no evidence that it assessed the risks, considered notification or determined how to prevent recurrence. It had not even answered the complainant’s letter. Its FIPPA responsibilities could not be delegated to the police complaints commissioner: the public body holding the information remained responsible for safeguarding it and responding to concerns.

Binding order, separate recommendations

Under section 58(3)(e), Kimmett required the department to stop the unlawful use and disclosure. Separately, the adjudicator recommended consulting a privacy expert and improving policies, training and practices. Suggested changes included annual training, confidentiality agreements, disciplinary guidelines capable of deterring breaches, clearer rules about personal discussions of police files, and procedures covering suspected breaches and mandatory reporting.

The decision therefore addresses institutional accountability as well as the original misuse. Legitimate access to sensitive records does not end a public body’s responsibility for what employees do with the information, and professional oversight does not displace its own privacy-law duties. The reasons do not establish that the recommended reforms have since been implemented.