City of Guelph took 11 months to notify 2,551 people affected by email leak

The City of Guelph has begun to notify the more than 2,500 people who were affected by an email leak in February 2017 — 11 months after it was first announced.

Over 13,000 emails included personal information including home addresses and salaries

Stephen O'Brien said the city had to analyze over 13,000 emails to identify all the individuals affected by the disclosure. (CBC)

It took 11 months, but the City of Guelph has finally started to notify the 2,551 people who were affected by the February 2017 email leak. 

Some emails contained information including home addresses and salaries. The statement from Stephen O'Brien, the city clerk, said the majority of the people affected were city staff.

While the files were recovered in late February, it took almost a year for the city to sort through over 13,000 emails, said O'Brien.

"We wanted to make sure that we had done our due diligence in terms of identifying all those who were impacted, and to do so, it took us some time," he told CBC K-W.

The leak happened during an exchange of information between city legal counsel and the former chief building official, Bruce Poole, who was suing for wrongful dismissal.

Emails unrelated to the litigation, which included confidential information, were also transferred in that process. The City found Mark Amorosi, the deputy chief administrative officer of corporate services, beared the "ultimate responsibility" for this leak.

The litigation settled in the same month.

Changes to protect privacy

According to a statement posted to the city's website, everyone affected will be notified by the end of January by phone email or mail, but O'Brien said a number of people have been proactively reaching to the City of Guelph to learn exactly what has been disclosed.

"We're able to sort of provide them with greater clarity and greater detail that we're not able to necessarily provide in the notification letter that they've received," he said.

O'Brien said the city has made changes so this type of personal information leak doesn't happen again.

"We're making sure that when departments are gathering information to share with a third party, they're only collecting what's absolutely necessary and needed."

Other changes include providing more specialized training and also tracking the transaction of documents with third parties.


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.,,,,,,,,,,