It took 11 months, but the City of Guelph has finally started to notify the 2,551 people who were affected by the February 2017 email leak.
Some emails contained information including home addresses and salaries. The statement from Stephen O'Brien, the city clerk, said the majority of the people affected were city staff.
While the files were recovered in late February, it took almost a year for the city to sort through over 13,000 emails, said O'Brien.
"We wanted to make sure that we had done our due diligence in terms of identifying all those who were impacted, and to do so, it took us some time," he told CBC K-W.
The leak happened during an exchange of information between city legal counsel and the former chief building official, Bruce Poole, who was suing for wrongful dismissal.
Emails unrelated to the litigation, which included confidential information, were also transferred in that process. The City found Mark Amorosi, the deputy chief administrative officer of corporate services, beared the "ultimate responsibility" for this leak.
The litigation settled in the same month.
Changes to protect privacy
According to a statement posted to the city's website, everyone affected will be notified by the end of January by phone email or mail, but O'Brien said a number of people have been proactively reaching to the City of Guelph to learn exactly what has been disclosed.
"We're able to sort of provide them with greater clarity and greater detail that we're not able to necessarily provide in the notification letter that they've received," he said.
O'Brien said the city has made changes so this type of personal information leak doesn't happen again.
"We're making sure that when departments are gathering information to share with a third party, they're only collecting what's absolutely necessary and needed."
Other changes include providing more specialized training and also tracking the transaction of documents with third parties.