Lessons Learned

As news stories evolve over time, it can become difficult to keep focus on the big picture. Reflection in hindsight can reveal interesting - sometimes startling - patterns in an otherwise rapid, chaotic event. PRIVA-CTM Research follows such news stories, the commentary on which may prevent others from repeating past mistakes in privacy management.

NOTE: Some external news stories may expire over time, resulting in dead links.



February 11, 2003
Internet adoption site removes privacy: critics - Internet adoption site draws immediate criticism because it "treats the kids as commodities and removes their right to privacy". Privacy Commissioner says he wasn't consulted about the site. [More…]

February 12, 2003
Adoption site under fire - Foster mother of three children says that neither she nor the children were ever told that the kids were up for adoption. They learned from friends at school the day after the website was launched. [More…]

February 12, 2003
Calling up a child - Ethicists, political opponents and the privacy commissioner raise concerns about the breadth of personal information on the site including a diagnosis of fetal alcohol syndrome and neglect by biological parents. [More…]

February 13, 2003
Adoptions on the Web - Clarification over confusion between the Freedom of Information and Protection of Privacy Office and the Office of the Information and Privacy Commissioner. [More…]

February 13, 2003
Calls for Alberta to shut down Internet adoptions - Article summarizes issues and concerns about adoption website. [More…]

February 14, 2003
Beware e-adoptions - "Will clicking on a government website turn children into commodities?" Director for Professional and Applied Ethics at the University of Manitoba addresses ethical issues raised by the Alberta adoption website. [More…]

February 15, 2003
Alberta privacy commissioner slams Klein government child adoption Web site - Privacy commissioner says that Alberta website "should temporarily shut down because it contains too much information that could be harmful to needy youngsters". [More…]

February 18, 2003
Evans says adoption site working - Alberta Minister of Children's Services says website "is working because it has had more than 500,000 hits". [More…]

February 21, 2003
Alberta social worker disciplined - An Alberta social worker is disciplined after three children in foster care learned they were up for adoption on the Internet. [More…]

February 24, 2003
Privacy Commissioner says adoption site OK - Privacy Commissioner says "Children's Services has the authority to disclose the children's personal information to help them find homes". [More…]

February 25, 2003
Alberta Minister cleared in Internet adoptions - Privacy Commissioner "has cleared the minister of children's services of wrongdoing in connection with a Web site promoting the adoption of children". [More…]

February 25, 2003
Adoption website allowed to resume - Article summarizes the Privacy Commissioner's findings allowing web site to resume. [More…]





The Alberta Children's Services Ministry thought they had covered all the bases in implementing the adoption website. They had completed a privacy impact assessment and obtained signoff from the Ministry's Freedom of Information and Protection of Privacy Branch. But the Ministry was caught off-guard by the torrent of criticism by privacy and child welfare advocates. Privacy fears were exacerbated when three children learned that they were up for adoption from friends at school; an error apparently caused by a careless employee. The Ministry was eventually cleared by the Privacy Commissioner after making adjustments to the website and operating procedures.

What can health organizations do to avoid or manage similar situations? Consider the following:

When planning a major initiative using the Internet, anticipate the concerns and questions that will be raised by privacy advocates and others. Be ready with reasoned and reasonable answers.

Make sure that clear procedures have been established and that all employees are properly trained. This incident was made worse by an employee who didn't follow the appropriate protocol.

Collect and disclose only the information absolutely required to achieve the objective or satisfy the defined purpose. Detailed and potentially damaging information was disclosed on this site that wasn't essential to the purpose or objective.

Engage the privacy commissioner or ombudsman early in your program development. At a minimum, the commissioner should be informed and given the opportunity to comment or make suggestions.

Consult with key stakeholders, including privacy advocates, to identify and resolve issues before going live with a web-based application that involves personal information.

Obtain consent from any person whose personal information is to be disclosed on the web or in any public media. It should be noted that in this case the children were wards of the province that had the authority to consent on their behalf. However, the children shouldn't have learned about the disclosure in the schoolyard.

Consider the risks of disclosing personal information where there might be the possibility of identity theft or placing a person in danger (e.g. in this case there was concern that information could be used by child predators).

>> Read the Alberta Information and Privacy Commission's Report on this incident.