Cisco Phone Recordings Notification

Unauthorized Collection of Information Incident

The City of Hamilton would like to inform the public about an incident involving the unauthorized collection of information due to a vendor software issue.

What Happened

The City’s telephone software provider experienced a global system issue that extended beyond the City of Hamilton on December 13, 2024. As a result, some phone calls transferred from the City’s Customer Contact Centre (905-546-2489) to an authorized third party were inadvertently recorded due to a vendor software bug. These unintended recordings constituted an unauthorized collection of personal information and personal health information.

Upon discovery: 

• Recording functionality was immediately disabled across the queue network until the issue was resolved. 
• The vendor, Cisco, investigated and confirmed that the issue was caused by a previously unknown software bug. 
• Only authorized City staff accessed the recordings as part of the investigation, and no other parties accessed them.

City staff promptly reviewed the call log for the City’s Customer Contact Centre to determine if there were any unintended impacts. Staff discovered that the recording function had not discontinued upon call transfers to an authorized third party. 

Due to the staff’s prompt diligence, we were able to identify and immediately report this issue to the vendor to ensure a quick resolution. 

• City staff reviewed and determined that a total of 575 calls were transferred of which 51 calls were recorded due to the software bug.
• Summary of recorded calls:
  • 25 calls were to external customers,
  • 16 calls were to Public Health Programs 
  • 10 calls were to specific Public Health staff.
• Some internal calls were also recorded, but as the City provides upfront notice that calls may be recorded for training and quality assurance, these calls were authorized but unintended. 

All affected recordings were securely contained, and there is no evidence of third-party access. The recordings have now been deleted.

How You Might be Affected

Personal information and personal health information contained within the recordings may have been collected without authorization. However, access to these recordings was restricted to a small, limited number of City staff who have confirmed that the only access to these recordings was in relation to the investigation of the vendor software bug and this incident.

What the City is Doing 

• Cisco has resolved the global system bug, and full testing has been done by the City to confirm the vendor fixed the issue.
• The City and the Medical Officer of Health have notified the Information and Privacy Commissioner of Ontario (IPC) as required.
• Unauthorized recordings were securely retained during the investigation and have now been permanently deleted.

If you are a City services user, no action is currently required.

Timeline of Events

• December 13, 2024: The breach notification protocol was followed, and the City’s Privacy Office worked with Information Technology staff to ensure the issue was contained by disabling call recordings across all queue lines. 
• December 20, 2024: The vendor confirmed a previously unknown defect in the software functionality. City staff requested a report to identify the scope of the potential breach and assess the impact.
• January 8, 2025: The vendor implemented a fix for the defect. City of Hamilton testing confirmed the issue was resolved. Following the testing, recordings were turned back on for the Customer Contact Center queue line (905-546-CITY).
• January 9, 2025: The vendor provided the requested Report.
• January to March: The internal investigation was completed, and notification was made. 

Next Steps and More Information

If you are a City services user, no action is currently required.

Should there be any further information about the incident, we will provide updates on this page. 

The City will not contact you by email, text, or phone requesting that you provide or confirm any personal information.

The City and the Medical Officer of Health have notified the Information and Privacy Commissioner of Ontario (IPC) of the breach. Individuals have the right to file a complaint with the IPC about their personal information through the following website www.ipc.on.ca/en/resources/information-individuals. While individuals are welcome to file a complaint, it is not required.

For more information related to this notification, please review the frequently asked questions. For general information and assistance related to the privacy incident, email [email protected]

Cisco Phone Recordings FAQ