Nova Scotia Power has proposed extraordinary measures for confidentiality during the inquiry into its substantial cybersecurity breach earlier this year. However, the overseeing board appears resistant to these suggestions.
In a public missive dispatched last week, Nova Scotia Power urged the Nova Scotia Energy Board—tasked with conducting the inquiry—to deviate from its established procedures. The utility is seeking the adoption of protocols akin to those employed by privacy regulators and aims to ensure that all submissions remain confidential for the inquiry’s duration.
This week, the energy board expressed its disapproval, categorizing the request for extensive confidentiality exemptions as “not acceptable or appropriate.” The board further noted the ambiguity surrounding the relevance of privacy regulators’ procedures to this inquiry.
The board reaffirmed its commitment to an open courts doctrine, emphasizing its intent to carry out the inquiry “as publicly and transparently as possible.
“Crystal Henwood, the board clerk, wrote, “It appears that NS Power believes it is entitled to unilaterally designate information it may file as ‘Board Confidential’ and expects that this claimed status will be accepted without review or question,” making it clear that such a methodology is not in line with the inquiry’s protocols.
Justification for Secrecy Required, Board Asserts
Henwood acknowledged that certain submissions during the inquiry may possess “quite sensitive” information that could merit confidentiality. Nonetheless, she insisted the utility must provide a justification for each instance.
Regarding a recent letter in which confidentiality was requested, the board specified that a precise rationale was required “for each and every paragraph.”
The utility’s CEO and other executives faced intense scrutiny from the public accounts committee concerning the cybersecurity breach that compromised data belonging to 280,000 customers. Michael Gorman reports.
The cybersecurity breach at Nova Scotia Power was initiated in March, when cybercriminals infiltrated the utility’s networks, accessing personal data of hundreds of thousands of customers. The utility only became aware of the breach over a month later, at which point it promptly informed the public.
In mid-May, the energy board notified the utility of its intention to undertake an inquiry into the incident, citing a need for “regulatory oversight and accountability.”
Since the announcement, numerous third parties have sought to intervene in the matter, including the provincial Department of Energy, the non-profit organization EfficiencyOne, a collective of the province’s major industrial players, a small business advocate, and a consumer representative.
Many of these entities are habitual interveners in matters concerning Nova Scotia Power, which allows them to offer comments and raise queries during the hearing process.
NS Power Aims to Exclude Interveners
In last week’s correspondence, a legal representative for Nova Scotia Power requested that participation be limited solely to the board and the utility itself, effectively seeking to exclude interveners.
Adam Kardash—whose firm specializes in privacy and data management—asserted that involving third parties would render the proceedings excessively “adversarial.” He emphasized that typical privacy investigations do not accommodate third-party participation.
The board responded minimally, only noting that several parties have indeed proceeded to intervene. Nova Scotia Power has informed over 280,000 current customers that their personal information may have been compromised during the attack. An undisclosed number of former customers have also been affected.
Kardash further stated that the company’s rationale for special rules and secretive submissions could not be divulged publicly, referencing a “Confidential Submission” for specifics.
The board countered that the justification for maintaining confidentiality lacked clarity, noting, “Much of the information appears to have already been publicly disclosed, is broad or general in nature, or simply articulates a position rather than revealing anything particularly sensitive,” according to Henwood.
Henwood insisted that a compelling reason for the confidential status should be presented.
Additionally, Kardash requested that all submissions remain classified until the board publishes its final report on the inquiry.
He also advocated for the board to provide Nova Scotia Power with a draft of its ultimate report prior to publication, allowing the utility to comment on “factual accuracy, the confidentiality of any commercial information, and the Board’s legal conclusions.” He reiterated that such a procedure is standard in privacy investigations.
Henwood stressed that the energy board does not function as a privacy regulator and observed that Nova Scotia Power seemed to “not sufficiently recognize” that the board’s methodologies are predicated on an “open courts” principle.
Source link: Cbc.ca.
