PIPEDA Case Summary #2017-005: Insurance company required to delete individual’s personal information after individual withdraws consent
An individual complained that his former automobile insurance company refused to delete his personal information from its records and from third-party organizations. The company initially refused, citing the need to provide insurance history to other insurers. The OPC reframed the request as a withdrawal of consent, and the company subsequently agreed to delete the information from its own records, as there was no legal requirement to retain it. However, the OPC found that the company was not obligated to ensure deletion from third-party records if the information was lawfully disclosed. The investigation also revealed the company lacked clear documentation regarding its disclosure practices to third parties, contravening Principle 4.1.4(d). The company committed to developing a document to track disclosures, which it later provided to the OPC.
- 1Whether the insurance company was required to delete the individual's personal information from its own records upon withdrawal of consent
- 2Whether the insurance company was required to ensure deletion of the individual's personal information from third-party organizations' records after lawful disclosure
- 3Whether the insurance company contravened Principle 4.1.4(d) by lacking a clear explanation of its disclosure practices to third parties
- Deletion of personal information: Company agreed to delete information from its own records
- Deletion from third-party records: Company not obligated to ensure deletion from third-party records
- Accountability for disclosures: Company lacked clear documentation of disclosure practices
- Compliance with Principle 4.1.4(d): Company committed to developing disclosure tracking document
Complaint well-founded and resolved in part, not well-founded in part, and well-founded and conditionally resolved in part (now fully resolved)
The company agreed to delete the information from its own records after the OPC reframed the request as a withdrawal of consent. The OPC found no obligation for the company to delete information from third parties if lawfully disclosed. The company addressed the accountability issue by developing a policy on third-party disclosures.
The company was required to delete the individual's personal information from its own records and committed to developing a document to track where and how personal information is disclosed to third-parties, making this information readily available upon request.
- Principle 4.1.4(d) PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro