In a recent decision, the Newfoundland Privacy Commissioner has ruled that the sending of personal financial information to a resident’s Facebook “inbox” was not permissible.
The town of La Scie had sent two individuals their personal financial information through Facebook. Because (at the time) the town did not have its own Facebook profile, the information was sent through an employee’s personal Facebook account.
While the Commissioner found that the personal information was not wrongfully disclosed (as the complainants were the only ones with access to their respective inboxes), the use of Facebook was improper as a less secure method of using personal information than available more secure means. Even if there was no more secure means, personal information should not have been shared over Facebook without the residents’ prior consent and the town’s confirmation that the Facebook profile actually belonged to that resident, which is virtually impossible for most social media platforms.
The Commissioner also took the opportunity to provide general recommendations to public bodies by saying that social media, regardless of whether or not such information is publically disclosed, should not be used to send or use personal information, and that social media platforms should be reserved by public bodies for general community information or responses to general questions about the public body.
For more information, please see the Commissioner’s decision at: www.oipc.nl.ca/pdfs/ReportP-2012-001TownofLaScie.pdf