Incident Summary #1: Misdirected faxes containing health information end up in apartment managers' hands
This incident summary details two separate investigations into misdirected faxes containing personal health information. In both cases, faxes from Dynacare and Viewpoint were erroneously sent to apartment managers. The OPC found that both companies disclosed personal information without consent, contravening PIPEDA. Dynacare implemented an electronic auto-fax function and revised policies, while Viewpoint committed to retrieving misdirected faxes and verifying numbers. The Assistant Commissioner recommended both organizations implement OPC faxing guidelines, notify affected individuals, and annually update employee confidentiality agreements.
- 1Whether Dynacare disclosed personal information without consent, contrary to PIPEDA
- 2Whether Viewpoint disclosed personal information without consent, contrary to PIPEDA
- 3Whether Dynacare's security safeguards were adequate to prevent misdirected faxes
- 4Whether Viewpoint's security safeguards were adequate to prevent misdirected faxes
- 5Whether Dynacare should notify the affected individual
- 6Whether Viewpoint should notify the affected individual
- Disclosure without consent: Contravention of PIPEDA by Dynacare
- Disclosure without consent: Contravention of PIPEDA by Viewpoint
- Remedial action: Dynacare implemented electronic auto-fax and revised policies
- Remedial action: Viewpoint committed to retrieving faxes and verifying numbers
- Recommendations: OPC faxing guidelines recommended for both
- Recommendations: Notification of affected individuals recommended for both
- Recommendations: Annual update of confidentiality agreements recommended for both
Complaints well-founded — corrective measures recommended
Both Dynacare and Viewpoint were found to have disclosed personal information without consent due to misdirected faxes, which constitutes a contravention of PIPEDA. While both companies took some corrective actions, the OPC issued recommendations for further improvements.
The Assistant Commissioner recommended that both Dynacare and Viewpoint implement OPC guidelines for faxing personal information, notify individuals whose information was inadvertently disclosed, and review and update employee confidentiality agreements annually.
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro