Saskatchewan’s privacy commissioner has found the Regina Police Service’s (RPS) disciplinary measures are “wholly inadequate” in the case of an officer who misused the police database to spy on citizens over the course of several years.

An investigation by the service’s professional standards branch found that Cst. Clinton Duquette had accessed the personal information of six people a total of 67 times without a legitimate need.

The snooping occurred over a period of three years, three months and 15 days from October 2021 to June 2024, according to Saskatchewan Information and Privacy Commissioner Grace Hession David’s report, which was published Dec. 11.

RPS Chief Lorilee Davies spoke on the report’s findings at a press conference on Thursday. She said she issued the disciplinary actions and said it was appropriate according to the Police Act.

“I have to rely on case law, precedence within the policing community, not just in Regina but within the country in terms of what are similar punishments,” she explained.

“This was meant, I believe to send a strong message to our organization and others in the province that this type of conduct won’t be condoned,” she added.

The commissioner found that RPS took minimal steps in containing the privacy breach and determined that the penalties imposed on Duquette were significantly inadequate, given the scope and length of the breach.

“The disciplinary measures adopted by RPS in this case are wholly inadequate and will not restore public faith in the RPS,” the report read.

Those disciplinary measures included one day without pay, the re-taking of a one-hour privacy training course and the re-signing of the RPS confidentiality protocol. Additionally, Duquette would be subject to random audits of the IEIS database for a period of two years.

“RPS must commit to a culture that reflects zero tolerance for inappropriate access of personal information. The RPS should consider severe consequences when violations are deliberate as in this case,” the report read.

“The public deserves to know that the RPS guards their privacy and protects their safety — the two concepts go hand in hand.”

In addition to inadequate penalties, the report noted RPS did not send letters to the affected individuals in a timely fashion.

The letters included details of the breach, a notification that the police officer had been disciplined, an apology, contact information of the RPS manager of access and privacy, as well as contact information for the Office of the Saskatchewan Information and Privacy Commissioner.

“The fact it took RPS three months to notify the affected individuals is concerning,” the report read. “Notification of affected individuals in a privacy breach should be given immediate priority given that a snooper may use the personal information for questionable purposes.”

The report also outlined the importance of preventing future breaches, as both the public interest and law demand that commitment from a police force.

“I deeply understand that the police have a great responsibility to the public, and the expectations of the public rightfully include a higher standard of conduct for us. This officer in doing this, failed to not only meet our expectations, but those of our community,” Davies said.

In March of 2025, Sgt. Robert Eric Semenchuck was charged with breach of trust by a public officer and unauthorized use of a computer, a matter the report said stands as “an unfortunate backdrop” for the service in the face of Duquette’s violations of privacy laws.

To prevent future breaches, the report said the RPS should prioritize implementing measures to get rid of any possibility of normalized snooping among employees, including enhancing safeguards, providing additional training, and regular monitoring of systems and system users.

In its findings, the commissioner noted it would be referring the matter to Saskatchewan’s Attorney General for prosecution under the province’s privacy act or LA FOIP.

The commissioner also recommended that Duquette’s access to the Integrated Electronic Information System or IEIS be permanently revoked.

“We will review the recommended recommendations included in this report and will respond to the office of the access and privacy commissioner within 30 days,” Davies said.