Alberta’s privacy commissioner is investigating after an alleged 2013 information breach at NorQuest College.
“Essentially, the investigation will look into the circumstances surrounding the alleged incident and then NorQuest’s response to it,” said Scott Sibbald, spokesman for the Office of the Information and Privacy Commissioner, Jill Clayton.
The college put a statement on its website in early September outlining the events that led to the investigation.
The statement said the college was “the target of an alleged fraud and misconduct relating to confidential information and financial assets.”
The breach happened in early 2013, when NorQuest found out a former employee had allegedly been sending inappropriate electronic messages using information that may have originated internally.
The college secured a court order to search the former employee’s home and found electronic devices that showed fraudulent transactions totalling about $1.2 million.
The release went on to explain NorQuest took “quick steps” to remedy the situation, recovering information and assets and taking legal action.
“The courts awarded legal remedies rarely given, which assured us that all confidential information and assets were recovered,” the release read.
A legal settlement was made and the school said all money and information had been returned and the Edmonton Police Service was informed, along with the Office of the Auditor General and the Ministry of Advanced Education.
NorQuest said it would not comment further as EPS were now “involved” in the situation.
“If there’s anyone else who feels that they were affected by this incident, they may submit a complaint to our office. What that will do is just provide a few more options that will be made to investigate this matter,” said Sibbald.
Alberta’s Freedom of Information and Privacy Act mandates that private institutions alert the privacy commissioner when breaches of this kind happen. A public body, NorQuest didn’t have to inform them and the commissioner was only made aware of it when the CBC began reporting on it.
The commissioner has made several recommendations in past for mandatory breach reporting for public institutions.
dlazzarino@postmedia.com
Twitter.com/SUNDaveLazz