B.C. steps in as local government struggles to get allegedly stolen files back from former IT manager

Thousands of copied internalfiles. Hundreds of documents with confidential information. A rogue IT manager accused of helping his son in a fightwith his neighbour. A defeated local government asking the province to bring in its top legal minister.

These are elements ofa drawn-out privacy-breach battleinvolving the largest municipality on Vancouver Island and one of its ex-employees, which recentlyescalatedto the point where B.C.'s attorney general has becomeinvolved to try to fix the situation.

"This is an unusual matter," said Troy DeSouza, a lawyer who's specialized in local government litigation for more than 25 years.

"It's not too often that you get internal unauthorized information accesses like this and then, more importantly, a refusal to either acknowledge or delete the information."

The province filed a rare petition in B.C. Supreme Court last week asking for a court order to force Guy Gondor, the man accused of copying the internal files, to destroy themor give them back.

2,500+ files copied to personal drive, claim says

The petitionclaimsthe privacy breach started with Gondor, the former ITmanager for the District of Saanich.

Gondor is accused of copying2,580internal files from a shared work driveto his personal drive on two occasions in December 2021 and January 2022.

Two months later, B.C.'s Office of the Information and Privacy Commissioner (OIPC) received two DVDsin the mail. They were loaded with district files mostly to do withSaanich'sengineering department.

Court documents said the DVDs were shipped anonymously.

Some of the filesconcernedGondor's son, Darian, who hasfor years been fighting with the district and his neighbours in a rural part of the municipality.

Darian Gondorhas met resistancetrying to turn his hillyMeadowbrook Ridge property into a hobby farm.Court documents said his neighbours have filed nearly 50 bylaw complaints against him, while he's filed nine against them.

The petition said Darianemailed the district to complain about hisneighbourcutting down trees two days after OIPC staff received the DVDs.

In his email, Darian attached two documents as evidence his neighbour has brokenrules. He said the files had "recently" come "into his possession," but didn't say how.

Saanich said the documents a letter and a field report had only ever been shared between district staff and the neighbour, and Darian neverfileda freedom of information request to get them otherwise.

Suspecting a leak, the district hired an outside firm to investigate. The petition saidKPMGfound Guy Gondor's employee login was the one used to copy the files and burn them to the DVDs.

It is still not known who mailed the DVDs to OIPC.

None of the allegations in the petition have been proven in court.

Guy Gondor has not filed a response to the claim in court and did not respond to requests for comment from CBC News.

301 files with addresses, emails

Aside from containing information about Darian Gondor's neighbour, the petition said a portion of thecopiedfiles contained other people's personal information, includingresidential addresses, names, email addresses, phone numbers, internal employee ID numbers and some"personal views and opinions."

Saanichsaid it sent Guy Gondor two letters asking him to return or delete the files last year. Court documents include a briefletter Gondor sent in response on June 16.

"l am confused as to why you would be sending me these letters as my access credentials would not provide access to personal information. As you are aware, my unique user name ... did not have any privileges that would grant access to any personal information," the letter read.

"In addition, my user name did not have access to any corporate applications that would have access to the personal information of the Saanich residents.

"I am a strong advocate for protecting the privacy of citizen's data and would not access data outside of the scope and duties assigned to me by the District of Saanich."

District asks province to intervene

In July 2022, the district asked the attorney general for help getting the documents back the first time the city has ever done so in a privacy breach case.

"Saanich is committed to protecting personal information and follows rigorous privacy and security processes in accordance with the Freedom of Information and Protection of Privacy Act (FIPPA)," the district said in a statement to CBC News.

"If a privacy breach occurs, Saanich takes immediate action to investigate, contain and secure the information."

Under FIPPA, B.C.'s attorney general has the authority to apply for court orders on behalf of a public body to forcepeople to return or destroy privateinformation if they aren't authorized to have it.

DeSouza, the lawyer, said the province has only won such an order once before.

In 2018, aformer city councillor in Nanaimowas among three people ordered to delete copies of confidential city documents and related online postsafter the attorney general filed a similar petition in B.C. Supreme Court.