City of Hamilton regrets privacy breach after voters’ info leaked

The City of Hamilton says it “regrets the errors” after violating the privacy of hundreds  of residents who registered to vote by mail for the Oct. 24 municipal election.

The gaffe was discovered on Thursday (Oct. 13), which was supposed to be Hamilton’s deadline to fill out a ballot and send it back in time for the votes to count. An email, from the office of City Clerk Andrea Holland, was sent out to address widespread concerns that people might not receive their ballot in time for it to be counted.

The email assured voters that all ballots were sent out Oct. 3, which is seven days later than listed in the Hamilton voting guide online. But it also included names on the city mailing list, making these names and the associated email addresses public, which flies in the face of the democratic principle of a secret ballot.

About 3,500 voters had registered to vote by mail, which is being attempted for the first time in the city. A media release on Friday said about 450 people had their privacy breached when their email addresses were “inadvertently” put in the “to:” line instead of “bcc:” (for blind carbon copy, meaning the addresses are not visible).

The statement reads:

“The City of Hamilton is aware of a privacy breach regarding personal emails that occurred on October 13, 2022 impacting approximately 450 individuals who had registered to use the Vote by Mail process,” The City regrets the error and any distress that this incident may cause those who have used the Vote by Mail process.

“Multiple email addresses were inadvertently entered in the to: line of the email instead of the bcc: line, exposing email addresses to all recipients of the email message.

“Immediate steps were taken to recall the message and to notify all affected individuals.

“The City of Hamilton takes the responsibility of protecting the security of individuals and their personal information very seriously and will conduct a review of processes to ensure staff are trained in the protection of personal information.”

By law, under the the Municipal Freedom of Information and Protection of Privacy Act, or MFIPPA, the city division responsible must self-report the mistake to Ontario’s information and privacy commissioner. The city said its manager of corporate records and privacy is “proactively reaching out” to the province.

How to act on the privacy breach

The city also provided addresses for anyone who is filing a privacy complaint regarding this incident.

• At the municipal level:
  Manager, Corporate Records and Privacy, City Clerk’s Division
  71 Main Street West, 1st Floor Hamilton, Ontario L8P 4Y5
  Phone: 905-546-2424 ext. 2743 | Fax: 905-546-2095 | Email: [email protected]
• At the provincial level:
  IPC Registrar, Information and Privacy Commissioner of Ontario
  2 Bloor Street East, Suite 1400 Toronto, Ontario M4W 1A8
  Phone: 1-800-387-0073 | www.ipc.on.ca

It is not the first time there has been confusion over election and campaigning procedures in Hamilton. There was one on the first official day of campaigning on May 2. Some candidates were told they could not use the city hall forecourt to announce their bids for elected office, while others were not but moved their events in solidarity. That led to events being held close to onrushing one-way traffic on Main St., where several traffic calming measures have been adopted following a council vote that happened the following week.