Government Oversight After Indigo Breach: HR Reporter Interviews Lawyer

After experiencing a ransomware attack, Indigo employees’ private information was leaked onto the dark web. Cyberattacks have increased in frequency over the past few years and have led to questions surrounding privacy rights and employee protections. Can employees pursue any legal action against their employers if data is compromised?

Karen Tereposky, an Alberta employment lawyer and Senior Associate at Samfiru Tumarkin LLP spoke to Sarah Dobson at Canadian HR Reporter on the recent attack and options available to employees.

“Under the privacy legislation, the collection and retention of data are subject to a “reasonableness” standard,” says Tereposky, “We probably need to have more guidance [from the government]… like a rule: ‘Keep it for this long and then get rid of it once your employees have left,’ but I think that’s part of the problem is that it’s just subject to this reasonableness thing, and that can be interpreted so many ways.”

Tereposky goes on to comment on Indigo’s offer to current and former employees and whether or not it can be considered reasonable. “It’s a prudent step and it probably insulates them a bit,” she says. “If there is any possibility of damage, then at least the employees are protected in a good faith move,” says Tereposky.

LEARN MORE
Severance pay in Alberta
Severance entitlements in B.C
Severance packages in Ontario

“It’s not that anybody has really had any harm or had any loss, I guess, at this stage, but people are just concerned about the unknown of what could potentially happen with this and what they can do to protect themselves.”