PIPEDA Case Summary #2016-004: Retailer shares customer’s in-store behaviour with the customer’s employer
A customer complained that a retail store employee disclosed his personal information, including his name and in-store behaviour, to his employer without his knowledge or consent. The Office found that the disclosed information was personal information and that the store could not rely on implied consent for the disclosure, as the information was sensitive and disclosure to an employer was not a reasonable expectation. The matter was resolved after the store implemented recommendations to communicate its PIPEDA obligations.
- Whether information disclosed in a public store is personal information.
- Whether implied consent applied to the disclosure of sensitive personal information to an employer.
- Whether the disclosed information qualified as publicly available information under the regulations.
Complaint well-founded and resolved.
The store disclosed sensitive personal information to the complainant's employer without knowledge or consent, and this disclosure was not supported by implied consent or any exception to the consent requirement under PIPEDA.
AI-generated summary for reference only. Always verify against the official decision ↗
The store formally communicated its PIPEDA obligations to the employee who made the disclosure and to its senior management.
- Principle 4.3 PIPEDA
- Principle 4.3.6 PIPEDA
- Principle 4.3.5 PIPEDA
- Regulations Specifying Publicly Available Information
This summary is informational only and not legal advice.