A long-withheld investigation into a 2019 hacking at LifeLabs Inc. that compromised millions of Canadians’ health data has finally been made public after an Ontario court dismissed the company’s appeal to prevent its release.

A statement from the privacy commissioners of both Ontario and British Columbia says their joint report, completed in June 2020, found that LifeLabs “failed to take reasonable steps” to protect clients’ data while collecting more personal health information than was “reasonably necessary.”

The report ordered LifeLabs to address a number of issues such as appropriately staffing its security team, and the commissioners’ statement says the company complied with all of the orders and recommendations.

LifeLabs had cited litigation and solicitor-client privilege to prevent the document’s publication, but this was opposed by the commissioners’ offices.