GSB# 2024-01337; 2024-01411; 2024-01636; 2024-01638; 2024-01640; 2024-01641

UNION# 2024-0290-0024; 2024-0290-0025; 2024-0290-0028; 2024-0290-0030; 2024-0290-0032; 2024-0290-0033

IN THE MATTER OF AN ARBITRATION

Under

THE CROWN EMPLOYEES COLLECTIVE BARGAINING ACT

Before

THE GRIEVANCE SETTLEMENT BOARD

BETWEEN

Ontario Public Service Employees Union (Plummer et al)

Union

• and -

The Crown in Right of Ontario (Ministry of Children, Community and Social Services)

Employer

BEFORE

Gail Misra

Arbitrator

FOR THE UNION

Gregg Gray Ontario Public Service Employees Union Grievance Officer

FOR THE EMPLOYER

Karen Martin Treasury Board Secretariat Employee Relations Branch Employee Relations Advisor

HEARING

November 27, 2024

Decision

1The parties have agreed to an expedited mediation-arbitration process to resolve grievances at the Roy McMurtry Youth Centre (“RMYC”) in Brampton. Although a formal protocol has not been finalized, the parties have agreed to attempt to settle matters at mediation and, if mediation is not successful, to refer appropriate cases to expedited arbitration. The parties specifically agree that the arbitrator can hear the matter under Article 22.16 of the Collective Agreement. This decision is issued in accordance with Article 22.16 of the Collective Agreement, so that it is without precedent or prejudice to any other matters between the parties, and is issued without detailed written reasons.

2This decision addresses six grievances filed by Youth Services Officers at the RMYC. The grievors, along with their respective Grievance Numbers, are as follows:

Christine Plummer, 2024-0290-0024 Adrion Smith, 2024-0290-0025 Catherin Jackson, 2024-0290-0028 Gloria Darboh, 2024-0290-0030 Jessica Muir, 2024-0290-0032 Nunziata Luciano, 2024-0290-0033

3All of the grievances were filed between July 29 and September 10, 2024 and all generally allege that the Employer violated Articles 2, 3, and 9 of the collective agreement and the Freedom of Information and Protection of Privacy Act (“FIPPA”) by allowing each grievor’s personal, private, and/or confidential information to be posted for anyone to access on the “P”, “H” or “A” drives of the Employer’s computer network. The grievors seek financial compensation for the alleged breach of the collective agreement, FIPPA, and their respective privacy.

4Many of the grievors provided written submissions in support of their claims and some outlined the quantum of damages they were seeking, which ranged from $1,500 to $10,000. One requested the removal of a suspension from their record.

5I have reviewed in detail each of the written submissions, and appreciate that the grievors outlined the nature of their concerns. Those included that any staff member could have viewed the person’s file online, which would have included their home address, other contact information, may have included information about discipline on their record, and so on. The grievors were particularly concerned that since they work in a youth facility, that some youth may learn of the grievors’ home addresses, thus putting the grievors and their families at risk for their safety. Many described feeling stressed as a result of the improper access that was granted to all employee files even though they did not know who or how many other staff members may have accessed their personal data.

6It appears that from 5:31 p.m. on July 15 to 12:30 p.m. on July 17, 2024 (a period of about 43 hours) folders and files that are normally password-protected and only accessible by a restricted number of Administrative personnel, were somehow unprotected and therefore available for any staff member at the RMYC to access. The RMYC Administration did not learn of the security breach until July 17, 2024, when it heard from an employee that all employees were able to access a restricted folder that contained confidential information. The Administration immediately took steps to have the unrestricted access shut down. It also requested that IT conduct an investigation into the nature of the breach, and who may have accessed files while the unrestricted access was available.

7The Union complains that it was not advised of the breach until July 24, 2024 at 10 p.m., almost seven days after the Employer had become aware of the issue. The Union and grievors are also concerned that they have not been advised about the outcome of the IT investigation.

8With respect to how long it took for the Administration to tell the Union and staff about the breach, the Employer explained that it had been hoping to have the Forensic Investigation Team report in hand so that it could answer the Union and staff member questions. However, when it was made clear to the Administration that such forensic investigations are very time consuming and would take much longer, the Administration decided to advise the Union and staff of what it knew. The Employer advised that the investigation is still ongoing as of the time of this hearing.

9It is important to note that in its submissions the Employer expressed its sincere and deep regret about the access breach. I also note that in an email to the Union and others, on July 24, 2024, the Youth Centre Deputy Administrator stated that on behalf of the senior management team she wanted to apologize for the breach.

10In considering this matter I have reviewed the jurisprudence tendered by the parties. In Ontario Public Service Employees Union (Myciak et al) v. Ontario (Ministry of Community Safety and Correctional Services), 2015 CanLII 90137 (ON GSB) (Briggs), the Board addressed a group grievance regarding the Niagara Detention Centre having electronically permitted access to a folder containing sensitive employee information, including regarding WSIB claims, on a public drive of the institution’s computer network. As in the case before me, the union claimed breaches of the collective agreement and FIPPA.

11In that instance, as here, the access breach had come to employees’ attention before management was aware of the issue, and the breach lasted for a few days. The arbitrator found that the employer had taken all appropriate steps once it became aware of the access issue, and had engaged IT services to ensure that inappropriate access was shut down. The employer had also initiated an investigation into how the breach had occurred.

12The arbitrator found, at para. 39 of the decision, that “Like others before me, I accept that FIPPA is an employment related statute and the substantive rights and obligations found therein are implicit in this collective agreement”. She went on to find at para. 43 that FIPPA had been breached, and that the types of records that had been made available to unauthorized staff through the employer’s computer system, albeit inadvertently, were within the purview of FIPPA’s protection. The grievance was upheld and remitted back to the parties to try to resolve what damages were owed to the grievors.

13In the second Ontario Public Service Employees Union (Myciak et al) v. Ontario (Ministry of Community Safety and Correctional Services), 2016 CanLII 13516 (ON GSB) (Briggs) decision, when the parties were unable to agree on the quantum of damages, the arbitrator ordered the employer to pay to the union the sum of $3,000 for distribution to the group of grievors. As there were approximately 53 grievors in the group, each received around $57 in damages.

14In the Ontario Public Service Employees Union (Manna et al) v. Ontario (Ministry of Community Safety and Correctional Services), 2018 CanLII 45302 (ON GSB) (Gee), the Board addressed another FIPPA breach group grievance regarding an inadvertent posting of personal employee information on the public drive of the Toronto South Detention Centre’s computer network. As that decision was issued pursuant to Article 22.16 of the collective agreement, it is without prejudice or precedent. However, it is instructive to the extent that the arbitrator, having found a breach of FIPPA, ordered the employer to pay $2,000 to the Union for distribution to an unspecified number of grievors in the group.

15In a different Article 22.16 decision regarding the same institution, a finding of a breach of employee privacy, and involving some of the same grievors, Ontario Public Service Employees Union (Manna et al) v. Ontario (Ministry of Community Safety and Correctional Services), 2018 CanLII 45292 (ON GSB)(Devins), the arbitrator ordered that the Employer pay to each grievor who had been publicly identified as being medically accommodated $350 in damages. The quantum appears to have been commensurate with the breach of confidentiality regarding the medical status of specific grievors.

16Having considered the parties’ submissions and the jurisprudence, I find that the Employer breached the FIPPA by exposing personal and confidential employee information for an almost two-day period on its computer drives that were accessible by any staff member. Its’ actions, albeit inadvertent and without purpose or malice, caused the grievors stress as sensitive information about them was accessible to other employees at the facility.

17I find that the Employer took action as quickly as it could once it became aware of the access breach, and that it sought a forensic investigation, which has yet to be completed.

18For the reasons outlined above, the grievances are therefore upheld. While I recognize that the last decision regarding damages (the Manna et al Devins decision, cited above) was for a more specific and known breach of the grievors’ confidentiality regarding their accommodation status in the workplace, that decision was issued about six years ago. Given the passage of time since the original Myciak et al decisions, cited above, and the generally higher degree of concern regarding breaches of personal and confidential information, I order that the Employer forthwith pay to each grievor the sum of $350 in damages for the FIPPA breach.

19As well, I direct that once the forensic IT audit of the access breach is completed and the Employer is provided with a report or outcome of the investigation, that, to the extent that it is feasible to do so, the Employer share the results with the Union and the grievors.

20The Grievance Settlement Board shall remain seized to deal with any matters arising from this award. If the parties cannot agree on a mediator-arbitrator, they may refer the implementation issue to the Chair.