Key takeaways
- On October 9, BC’s privacy commissioner found Kamloops Mayor Reid Hamer-Jackson disclosed the personal information of four people, including a former employee’s health details, in violation of FIPPA’s s. 25.1.
- The mayor must now get written permission from the head or delegate before disclosing any staff personal information, and comply with the City’s containment directions by October 13, 2026.
- The City’s own breach response was found compliant, a useful template for municipalities whose insider holds elected office.
What the mayor did
On August 27, 2026, the mayor emailed a 66-page PDF of text messages to three local Facebook-group operators plus the City’s external legal counsel. The texts, exchanged with a former City employee between October 2022 and August 2023, held the personal information of four individuals: the former employee’s health diagnosis, symptoms, and treatment plans, plus a code-of-conduct matter naming a councillor and a staffer.
The mayor said he sent the messages to contradict a public narrative about his relationship with the former employee. The City reported the matter to the OIPC on September 3; the formal investigation opened September 15, and the order (F26-87) is dated October 9.
Why training never stood a chance
A similar disclosure in March 2026 produced letters from the City (March 31) and the Commissioner (April 10), plus an April 13 call in which the OIPC’s Director of Investigations spelled out the rules. In total, the order records guidance on at least nine occasions going back to November 2022, including a mandatory session titled “Privacy Obligations for Elected Officials.” None of it stuck: 35 reported breaches, with disclosures continuing during this investigation. Practitioners on Reddit put it plainly: training does not fix intent. The investigator’s formal version: willful ignorance or deliberate disregard under FIPPA.
The legal analysis worth keeping
Elected officials are officers. Relying on R v Skakun (2014 BCCA 223), the investigator confirmed that municipal elected officials are “officers” of the public body for FIPPA’s individual obligations, so the s. 25.1 duty not to disclose personal information except as FIPPA authorizes applies to a mayor directly.
“FOI-able” does not mean releasable. The mayor’s implied argument was that records which could be requested through an access request are fair game. Both the City and the Commissioner rejected this: only the head of the public body, or their delegate, decides what can be released through Part 2 of FIPPA. The mayor was neither the delegated decision-maker nor responding to an access request. As the City’s March letter put it: FOI-able means the records can be requested, not that they can be released.
Self-defense in public is not a disclosure purpose. No s. 33 authorization fit: no consent, and contradicting a public narrative was neither the original collection purpose nor a consistent purpose under s. 34. The expectation test from Investigation Report 00-01: would the individuals expect their information to be used this way? Plainly not.
What the City got right
The City’s own breach response was found compliant with ss. 30 and 36.3, a template for municipal privacy teams:
| Step | What Kamloops did | OIPC’s assessment |
|---|---|---|
| Containment | Within about five hours, directed recipients to double-delete all copies; issued a s. 73.1 demand notice to the non-responsive recipient; directed the mayor the same day to cease disclosure | Reasonable; mixed success from non-cooperation |
| Risk assessment | Identified four affected individuals, flagged health and employment details as sensitive; disclosure to commentators magnified foreseeable harm | Concurred |
| Notification | Notified three affected individuals and the OIPC seven days after discovery; amended the letters October 1 to add the missing breach date | No unreasonable delay |
| Prevention | No safeguard could have prevented a deliberate disclosure; abundant training and warnings were documented | Exhausted |
The one gap, a missing breach-discovery date in the notification letters, was fixed with an October 1 follow-up the investigator accepted as full compliance.
The order, and why its design is the real lesson
Recommendations had been exhausted, 35 reported breaches in. Pursuant to ss. 58(3)(a) and 58(4), the investigator ordered the mayor to comply with his duty not to disclose personal information obtained in the course of his duties. As a condition, he must now get written permission from the head or their delegate before disclosing any personal information of current or former municipal staff, and comply with the City’s August 27 containment directions by October 13, 2026. Non-compliance lets the OIPC file the order with the Supreme Court under s. 59.01.
That written-permission condition is the interesting part. Privacy regulators almost always aim their enforcement at organizations, so a permission-first order naming one person is an exceptional step. When the person cannot be trusted with the decision, the regulator moved the decision away from the person: the mayor no longer decides what he may share; the Privacy Officer does.
Actionable takeaway: If your organization answers to elected officials, treat the disclosure decision as a control, not a person. Kamloops had the right architecture: a delegated Privacy Officer as the disclosure decision-maker, a written position that FOI-able means requestable, and a documented trail of training. The only gap was enforcement against the one person who would not follow it. Write your policies for the day the most powerful person in the building is the breach.