The laboratory services provider was hit by a data breach in 2019
LifeLabs has announced plans to appeal a court ruling that supports the decision by the Information and Privacy Commissioner of Ontario (IPC) and the Office of the Information and Privacy Commissioner for British Columbia (OIPC) to release their joint investigation report on the 2019 cyberattack that compromised the company’s computer systems.
The IPC and OIPC conducted a joint investigation into the attack, which affected over eight million customers in Ontario and British Columbia. They finalised their report in June 2020 and concluded that LifeLabs did not meet its obligations under Ontario’s Personal Health Information Protection Act (PHIPA) and BC’s Personal Information Protection Act (PIPA).
Specifically, the report found that the laboratory services provider failed in “its duty to take reasonable steps to safeguard the personal information and personal health information of those affected by the breach.”
LifeLabs had complied with the orders and recommendations in the report but argued against its public release, citing concerns that it contained solicitor-client and litigation-privileged information. It later sought a judicial review of the IPC and OIPC’s decision to publish the report.
The Divisional Court of Ontario ruled in support of IPC and OIPC’s decision this April, stating that health information custodians cannot avoid their responsibilities under the province’s health privacy law by classifying facts about privacy breaches as privileged information.
In response to this ruling, LifeLabs has announced its intention to bring the case to the Ontario Court of Appeal. This will prevent the IPC and OIPC from publishing their report until a decision is made on whether any of its contents are privileged or confidential, as the company claims.
Both offices said in a statement that they will not provide further comments while the matter is still before the courts.
