Hamilton’s exposure of 59 delegates information prompts investigation

The City of Hamilton is under investigation by the Privacy Commissioner after staff leaked the personal information of 59 people who registered to delegate during the 2024 budget meetings.

On Jan. 16, the city leaked the delegates’ email addresses, home addresses and phone numbers in the publically posted January 16 General Issues Committee Budget – Addendum and Merged Agenda. The city initially claimed only the emails had been compromised. However, reporting from Joey Coleman indicated they had also shared the other information.

.@CityofHamilton issuing misleading statements regarding the latest City Clerk's privacy breach.
Claiming the breach only revealed email addresses.
Breach included delegates' home addresses and cellphone numbers.
Typical cover-up behaviour from City Hall. #yhmcc #HamOnt

— Joey Coleman (@JoeyColeman) January 17, 2024

While Coleman alleged a cover-up, the city claimed it only learned about the home and phone number leaks after “further review.”

“Based on information known at the time of the breach, affected individuals were notified that their email addresses were impacted by the breach. Upon further review, it was found that the information the City originally shared with those impacted and the public was not fully accurate,” the city wrote on Jan 23.

The review discovered the posted agenda was redacted with a program the city’s eScribe site does not support. As a result, the information that was meant to be blacked out was plainly visible. Additionally, the city at first believed only 32 delegates had been affected, but later learned the actual number.

The city has contacted each delegate to inform them of the leak and apologize. They’ve also issued a public apology saying, “The City regrets this error and apologizes for any distress it may cause.”

Additionally, the city re-redacted the eScribe files with the protected information and informed the Office of the Information and Privacy Commissioner. “While it is believed this is the extent of the online breach, the City wants to assure the public that we are taking steps to learn from this incident, ensure the error is not repeated, and strengthen our organization,” the city wrote.

These efforts include “staff training programs, process improvements and enhanced confidentiality protocols.”

“The City is committed to taking concrete actions to address this matter and prevent future reoccurrence,” Hamilton continued, “The City of Hamilton takes its responsibility of protecting the security of individuals and their personal information very seriously and is fully committed to upholding the highest standards of accountability and transparency.”

Despite these assurances, this is far from the first leak from city hall. Back in December, the Police Service Board leaked confidential information about a potential board candidate. Before that, the city leaked the email addresses of 450 residents who had signed up to vote by mail in the 2022 municipal elections.