Alleged misuse of law-enforcement databases is at the centre of the recent Project South police corruption probe, which has resulted in seven active Toronto Police Service officers being criminally charged.Fred Lum/The Globe and Mail
Ontario’s Information and Privacy Commissioner, Patricia Kosseim, says there will be a “zero-tolerance policy” for database breaches by police under new powers her office will soon have to help investigate and prevent unauthorized snooping.
Police officers in Ontario have access to various law-enforcement databases containing troves of confidential personal information. However, unlike provincial institutions, most of the province’s police services are not required to report database breaches to the Privacy Commissioner’s office.
Alleged misuse by officers of these databases is at the centre of the recent Project South police corruption probe, which has resulted in seven active Toronto Police Service officers being criminally charged. Ontario’s Inspectorate of Policing is performing a systemic review of police anti-corruption practices throughout the province, including database usage, as a result of the case.
Thirty federal cases affected after Toronto police officers charged in Project South probe
Ms. Kosseim said in an interview that her ability to monitor police data breaches will be boosted next year, when new amendments to Ontario’s municipal privacy legislation are scheduled to take effect.
The changes to Ontario’s Municipal Freedom of Information and Protection of Privacy Act, which were passed as part of the province’s budget bill in April, she said, could be a game-changer for police accountability for more than 40 police forces in the province.
The amendments, which Ms. Kosseim said she had long called for, mean that municipal entities such as police forces will have to start producing privacy impact assessments of new technologies and disclosing data leaks to her office.
The threshold for mandatory data leak disclosures is defined in the legislation as a “real risk that a significant harm to an individual would result.” Ms. Kosseim said this has to be interpreted broadly. “Harm does not mean just physical harm or threat of physical harm,” she said. “It could mean harassment, reputational harm, any harm.”
Saskatchewan has highlighted how privacy commissioners and police chiefs can work together to crack down on such data leaks.
Earlier this month, the Regina Police Service charged one of its police officers with unlawfully snooping on the data of six people dozens of times over a span of about three years.
Now, he could face up to a year in jail or a fine of up to $50,000 if he is convicted of breaking the province’s information laws. This charge was laid after Saskatchewan’s privacy commissioner recommended it in a public report, finding the force’s initial punishment – docking the officer one day’s pay – was “wholly inadequate.”
Under the Ontario watchdog’s new powers, police will have to notify both affected individuals and the privacy commissioner. “The law was changed to give my office more explicit and expansive investigation and enforcement powers, including the power to issue binding orders,” Ms. Kosseim said.
Her office highlighted to The Globe clauses in the new statute saying that in some circumstances a privacy commissioner can order the head of a municipal institution to discontinue or change an information practice, or even “implement a different information practice as specified by the Commissioner.”
Ms. Kosseim urged police chiefs in the province to start better protecting their databases while also preparing to work more closely with her office.
Practices “need to be sharpened now, because the stakes are much higher,” Ms. Kosseim said. “Our position is always that there should be zero tolerance for any kind of snooping behaviour.”
The imperatives toward greater disclosures could lead to tensions with police.
In response to questions for this story, Toronto police spokesperson Stephanie Sayer said, “To protect the integrity of an active investigation, the Toronto Police Service does not publicly disclose or notify parties about personal information breaches while the matter is ongoing.”
Ms. Sayer said police do have their own independent mechanisms to warn people if they are in harm’s way. She said her police service – Canada’s largest municipal force – will adhere to the new privacy laws “at the appropriate time in a way that does not compromise the administration of justice.”
The privacy commissioner is one of several Ontario watchdogs now investigating the circumstances behind the Project South corruption case.
The probe was sparked by the alleged attempted killing of a corrections officer at his home.
Investigators then worked backward, determining that a Toronto Police Service constable had allegedly used police databases to leak information that ultimately led to the attempted hit. Later, investigators discovered other cases of violence allegedly triggered by data leaks from police.
Along with the seven active TPS officers accused in the case, one retired officer has been charged, as well as 19 civilians. The allegations against them have not been tested in court.
Ms. Kosseim said she learned in the media about the potentially deadly Toronto Police privacy breaches arising in Project South.
No one, she said, has ever officially notified her office about the privacy implications of this high-stakes case. “I was surprised, given the seriousness of the breach and the allegations,” she said. “Although the law will now require them to, as of Jan. 1, 2027.”
Ms. Kosseim declined to share details of her investigation into the privacy breaches at stake in Project South.
Both the York and Toronto forces have asked Ms. Kosseim to pause her work, citing concerns about the possible impact on the continuing criminal probe, Ms. Sayer said. (York Regional Police are leading the Project South investigation.)
“Both services have taken the position that an IPC investigation at this stage could interfere with the active criminal investigation and ongoing prosecutions, and have asked that it be postponed for that reason,” Ms. Sayer said.
“I can confirm that my office has received a request to postpone our investigation,” Ms. Kosseim said. “We are assessing the request at this time.”