Privacy Commissioner Investigating Centurion Project. Strongly Worded Letter Could Follow
The lack of any real privacy laws could play a role in the Centurion Project scandal that exposed millions of Alberta voters.
#News #Privacy #Security #Alberta #Canada #CanPol #CenturionProject #DataLeak #JasonKenney #politics #PrivacyCommissioner #PrivacyReform
So of course the NZ Privacy Commissioner will be pushing for third-party service providers to be subject to the OIA for every aspect of public service work they handle, just like the agencies commissioning them, right? Riiiight?
(2/2)
@biddy_sue @felix @kyhwana @ThisCJ @oseiler
Privacy Commissioner's response to ManageMyHealth breach: A masterclass in looking busy while doing nothing
Timeline:
29 Dec 2025: ManageMyHealth breach detected (108K-126K users affected)
21 Jan 2026: Privacy Commissioner announces inquiry
31 Mar 2026, 16:30: Privacy Commissioner sends email (effective 1 Apr - <24hrs notice)
What the email says:
Enquiries email address closing 1 April
All complaint actions PAUSED until inquiry completes (no timeline given)
To complain, you must FIRST:
• Contact ManageMyHealth (who didn't respond to my 3 emails)
• Contact Te Whatu Ora
• Contact your GP
• Provide documentary evidence of all attempts
• Prove you gave them "reasonable chance to respond"
Must demonstrate individual harm (not "general concerns about the breach")
The Catch-22:
Data not breached? = No individual harm = "general concerns" = not actionable
Data was breached? = Must exhaust remedies with organisations that failed to protect you first
Either way? = Complaint action paused indefinitely anyway
What this reveals:
The Privacy Commissioner is conducting an inquiry (looks like action) while making individual complaints nearly impossible (avoids making findings against government agencies/contractors).
Independent security analysis showed ManageMyHealth had:
DMARC set to monitoring only (anyone could spoof their domain)
Weak 1024-bit DKIM keys (not industry standard 2048-bit)
Zero DNSSEC protection across 19 subdomains
Misconfigured email transport security
These are basic infrastructure failures, known best practices for over a decade.
But apparently that's a "general concern" not worth the Privacy Commissioner's time.
Sent at 16:30 on 31 March, effective 1 April. You were meant to miss it.
#NZPol #Privacy #DataBreach #ManageMyHealth #PrivacyCommissioner #Accountability
Freezenet
Strypey
CBC Saskatchewan
Peter Stone
Global News
CBC Kitchener-Waterloo
CBC Thunder Bay
CBC Ottawa