Data Breach Notification

EMMEDIA would like to notify the community about a data breach. 

EMMEDIA collects personal information and Identification card (ID) images from its Artist Affiliates for operational and insurance purposes. Artist affiliates would upload ID images to our website via a form when applying for the program, with the images stored on our web server. The folder containing the images was inadvertently configured with public viewing permissions. As a result, these images could be accessed and downloaded by individuals who knew or obtained the specific URLs. We do not have any evidence that the information was accessed maliciously, but we cannot rule out that possibility.

We were notified of the issue on September 2, 2026 when an affected artist reported that their personal information was publicly accessible. EMMEDIA made all the images unavailable on September 2, and launched an investigation on September 4. Based on that investigation, the earliest indication that the images were publicly available is from January 20, 2024 and they were available until September 2, 2026.

We have reported the breach to the Office of the Information and Privacy Commissioner of Alberta, and have notified all impacted individuals with additional details. 

We have changed the application process for the Artist Affiliate program and while we must  collect ID for insurance purposes, we will do so only in person going forward and will keep the information in a locked cabinet. Artist Affiliate information will be retained while the artist is an affiliate of EMMEDIA. The information will be destroyed five (5) years after an artist withdraws from the Artist Affiliate program, or five (5) years after an artist has become inactive in the program. If an inactive artist would like to rent equipment or use the space in future, EMMEDIA will collect a new copy of their ID, stored in a locked cabinet under the same retention policy.

EMMEDIA is appointing Joe Kelly as its internal Privacy Coordinator, along with Kathryn Blair as current board privacy liaison. They will collaborate on a formal Records Retention Policy and Privacy Policy which will be posted publicly on EMMEDIA’s website by December 16, 2026.

We understand that this breach is very distressing for our artist affiliates and the community at large, and we would like to acknowledge that and apologize to our community. If you have any questions or concerns about the breach or actions we are taking going forward, please contact privacy@emmedia.ca and we will respond to you as soon as possible.