Sending confidential information in unprotected email

NB: Unofficial translation

The Deputy Chancellor of Justice drew the attention of the director of the day-care centre to the provisions of the Act on the Openness of Government activities concerning the processing of confidential information and the sending of e-mails containing confidential information as secure email.

The director of the day-care centre had inadvertently responded directly to an email message sent by the complainant. The reply had also gone to the Service Manager, who had also been the addressee of the complainant's original message. The Deputy Chancellor of Justice considered that the email message contained confidential information on social welfare services under the Act on the Openness of Government activities that should not have been sent in an unprotected email or to a third party. Thus, the director of the day-care centre had not acted as required by the Act on the Openness of Government activities and had not complied with the city's data protection guidelines.

In the Deputy Chancellor of Justice’s opinion, the city had acted in accordance with good information management practices. Among other things, the city had ensured that its employees had the necessary information on the procedures to be followed in handling confidential information as well as protecting it and information systems, such as sending email as secure email.