Atwell claimed earlier this year that the software was being used to to spy on him by recording his keystrokes and taking screen shots.
While Privacy Commissioner Elizabeth Denham's report doesn't deal directly with Atwell's allegations, she found that the security software installed by city staff collected far more information than allowed under the Freedom of Information and Privacy Act.
"When the District of Saanich implemented employee monitoring software, staff enabled tools that would collect sensitive personal information from employees including personal websites visited, online banking transactions, confidential correspondence and private passwords or images," Denham said in her report.
Saanich collected personal information
"The district can only collect personal information that is directly related to and necessary for the protection of IT systems and infrastructure. An employee's every keystroke and email, or screen captures of computing activities at 30-second intervals clearly exceeds that purpose and is not authorized by privacy law."
Denham said the District of Saanich failed to provide adequate notice of the amount and type of information it was collecting. She has ordered the District to destroy the data and says it has agreed to do so.
The Saanich mayor made national headlines in January after alleging staff used a program called Spector 360 to track his actions on his computer while the district said it was simply following through on recommendations from a security audit that recommended the software.
Saanich police conducted their own investigation and found nothing wrong with security software installed on Atwell's computer.
Denham said she was surprised at the district's almost complete ignorance of privacy laws.
"One of the most disappointing findings in my investigation is the district's near-complete lack of awareness and understanding of the privacy provisions of B.C.'s Freedom of Information and Protection of Privacy Act," she said. "The law has been in place for more than 20 years, yet the district appears to not understand its most basic privacy provisions."
The District of Saanich removed the Spector 360 spyware from its computers in January when Denham first announced her investigation.
She is recommending the district appoint a chief privacy commissioner to audit its current access to information and provide training to ensure it's meeting its privacy obligations.