CASE STUDY: Employee Offboarding and Privacy

How the Government of the Northwest Territories failed to recognize, respect, and protect personal information.      

Before getting into the particular facts of this case, let's first consider what an appropriate protocol for dealing with an information breach might look like: 

Know which information requires protection, actually take steps to protect that information, and be aware that any circumstance where that information can leave the organization or be accessed from outside of the organization, there is an opportunity for breach. 

Having recognized that a breach has occurred, the first step is to take adequate steps to contain the data to ensure no further loss or vulnerability. If this requires shutting your systems down and locking your doors, do so.

Identify where the breach occurred, where the data went, and then secure the return of that data.

Assess the risk of harm that may result from the loss or exposure of the data in question. If there is real risk, notify the persons involved. 

Eliminate the vulnerability. Learn from the experience. Continue to be vigilant and be ready to recognize when future breaches occur.