PIPEDA Findings #2019-001: Investigation into Equifax Inc. and Equifax Canada Co.’s compliance with PIPEDA in light of the 2017 breach of personal information
The Office of the Privacy Commissioner of Canada (OPC) investigated a 2017 data breach that compromised the personal information of approximately 19,000 Canadians held by Equifax Inc., the US parent company of Equifax Canada Co. The investigation examined the adequacy of security safeguards by both entities, Equifax Canada's accountability for data processed by Equifax Inc., the validity of consent obtained for data transfers, retention practices, and the sufficiency of post-breach mitigation measures. The OPC concluded that both Equifax Inc. and Equifax Canada contravened PIPEDA in all these areas, citing inadequate vulnerability management, network segregation, basic information security practices, and oversight. Equifax Canada signed a compliance agreement, committing to corrective measures for most findings, which were deemed well-founded and conditionally resolved. However, the finding regarding post-breach safeguards was only partially resolved, as Equifax Canada committed to extended credit monitoring but not a free credit freeze product.
- 1Whether Equifax Inc.'s security safeguards were appropriate to the sensitivity of the information as required by PIPEDA Safeguards Principle 4.7.
- 2Whether Equifax Inc.'s retention and destruction practices for Canadian personal information complied with PIPEDA Principle 4.5.
- 3Whether Equifax Canada demonstrated adequate accountability for protecting Canadian personal information handled by Equifax Inc. as required under PIPEDA Principle 4.1.
- 4Whether there was adequate consent from Canadians for the collection of their personal information by Equifax Inc. and disclosure to Equifax Inc. by Equifax Canada, as required under PIPEDA Principle 4.3 and s.6.1.
- 5Whether Equifax Canada's security safeguards for personal information it held directly were appropriate as required by PIPEDA Safeguards Principle 4.7.
- 6Whether the post-breach mitigation measures offered by Equifax Canada were adequate to protect against unauthorized use of compromised personal information as required by PIPEDA Safeguards Principle 4.7.1.
- Security safeguards (Equifax Inc.): Contravention found
- Security safeguards (Equifax Canada): Contravention found
- Accountability for data: Contravention found
- Validity of consent: Contravention found
- Retention practices: Contravention found
- Post-breach mitigation: Contravention found, partially resolved
- Compliance agreement: Signed for most findings
Well-founded and conditionally resolved (most issues), partially resolved (post-breach safeguards)
The OPC found multiple contraventions of PIPEDA by both Equifax Inc. and Equifax Canada across several principles. Equifax Canada committed to a compliance agreement to address most of these issues, leading to a conditional resolution, but did not fully agree on the recommended post-breach credit freeze product.
Equifax Canada committed to a compliance agreement to implement a written arrangement with Equifax Inc. for data handling, institute a robust monitoring program, delete personal information no longer required, provide regular audit reports to the OPC, and revise consent communications. It also committed to extended credit monitoring for affected individuals, but not a free or low-cost credit freeze product.
- Principle 4.7 PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.1 PIPEDA
- s.4.1.3 PIPEDA
- Principle 4.3 PIPEDA
- s.6.1 PIPEDA
- s.4.3.4 PIPEDA
- s.4.3.5 PIPEDA
- s.4.7.1 PIPEDA
- s.7(3) PIPEDA
This summary is for informational purposes only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro