BC Assessment Changes Website After Privacy Failure

BC Assessment has disabled a new tool on its website that made the names of the owners of every property in the province easily available to anyone.

Juli Mallett, a Salt Spring Island homeowner who previously worked in information security, noticed the issue late one night.

“Frankly a lot of the tools that the province puts out feel sort of rushed or incomplete,” she said. “This seemed like something that was done especially clumsily.”

Early each January BC Assessment, a provincial Crown corporation, releases its estimates of what properties in the province are worth.

The agency sends the information about each property by mail to its owners.

It also makes all the assessments publicly available through its website, in past years without ownership information, so that people can consider whether their property has been valued fairly compared to other properties.

Altogether the assessments cover more than 2.2 million B.C. properties, worth $2.75 trillion. Local governments and others use the information to determine taxes on each property.

This year BC Assessment introduced a new “view property assessment” feature that allowed website users to download a PDF of any assessment in the province. Unlike the printed ones sent to individuals, they were not supposed to include ownership information.

When Mallett downloaded the one for her property she noticed it was very similar to the one she receives each year in the mail, but with some information stripped out.

“I used to work in the world of information security, so my first thought is, 'OK, so this is clearly output from the same system that produces the version that I get in the post, I wonder if they might have slipped up,'” she said.

“I just searched for my last name in that file and instantly saw it highlighting some white-on-white text.”

From there it was easy to uncover that the text was what appeared to be a file name that included both her name and the name of the co-owner of the property.

Mallett tried a few other documents for properties where she knew the owners and found they had similar text embedded in them that made it easy to uncover the owners’ names.

“It’s not the most private of information, who owns what property,” she said. The same information can also be retrieved through the Land Title and Survey Authority, except with a fee for each record and with more effort.

“The thing I thought was interesting was they explicitly called out that they weren’t including the owner information, then they kind of sort of were,” she said. “This was just something that was wide open to the internet and clearly contrary to their intent. Somebody had tried to do something there [to hide the owners’ names] but had not quite gotten it right.”

Mallett flagged the issue in emails to both BC Assessment and the Office of the Information and Privacy Commissioner hoping someone would act on it.

“In my time when I worked in information security, it was my experience that people take vulnerability reports and information leak reports varying degrees of serious and it’s often hard to get that attention,” she said.

By Wednesday afternoon BC Assessment had disabled the feature and posted a note on its website saying, “Due to a temporary technical issue the Digital Assessment Notices are not currently available.”

A spokesperson for BC Assessment, Tim Morrison, responded to The Tyee’s questions by email. “BC Assessment is aware that property owner names could have been viewed through our website, but only if a person took secondary efforts to reveal that information,” he said. “The same information is already available to the public through other sources and we have removed it from our website.”

OIPC spokesperson Michelle Mitchell confirmed that the commissioner’s office has been in discussion with BC Assessment about the issue, but said the Freedom of Information and Protection of Privacy Act prevents her from providing specifics.

“The OIPC will continue to monitor the issue,” she said. “If any individual has concerns about how their personal information was handled they should first contact BC Assessment, and if they are not satisfied with the response they can then contact our office.”

The head of the BC Freedom of Information and Privacy Association advocacy group, executive director Jason Woywada, called BC Assessment’s slip-up “a potential textbook example of bad information management by public bodies.”

Assessment information needs to be available for informed market decisions and for transparency, he said, but “the broad systematic proactive release of potential location information tied to personal information is deeply problematic.”

Examples of people who might be put in danger by having the information released include people escaping domestic violence or who are targets of domestic or foreign criminal gangs, he said. “There are multiple instances where this could be a considered a breach that could place people in harm's way.”

Privacy legislation allows public bodies to balance the public interest by proactively releasing only what needs to be released while making other information available upon request, he said.

“We'd expect the public body to be able to do these things routinely in regular operation,” he said. “It's reasonable that the public expects better from our public bodies.”