PIPEDA Findings #2019-004: Joint investigation of AggregateIQ Data Services Ltd. by the Privacy Commissioner of Canada and the Information and Privacy Commissioner for British Columbia
This joint investigation by the OPC and OIPC BC examined AggregateIQ Data Services Ltd. (AIQ), a BC-based company providing data services to political campaigns globally, for its compliance with PIPEDA and PIPA. The investigation focused on AIQ's consent practices for collecting, using, and disclosing personal information, and its security safeguards. The Commissioners found that AIQ failed to ensure adequate consent for its work with SCL Elections (US campaigns), Vote Leave (Brexit), and some Canadian campaigns, particularly regarding the use of sensitive information and disclosure to social media platforms for targeted advertising and analytics. They also found that AIQ failed to implement reasonable security measures, leading to a data breach that exposed login credentials and put the personal information of 35 million people at risk. While the security issue was resolved through AIQ's remedial actions, the overall matter was deemed well-founded-conditionally-resolved as AIQ committed to implementing recommendations regarding consent verification and data deletion, with a follow-up planned.
- 1Whether AIQ was compliant with consent requirements for the collection, use, or disclosure of personal information under PIPEDA and PIPA.
- 2Whether AIQ could rely on consent obtained by its clients for its own collection, use, and disclosure of personal information.
- 3Whether consent was adequate for specific uses, such as disclosing personal information to Facebook for "custom audiences" and "lookalike audiences."
- 4Whether consent was adequate for sensitive personal information, such as political opinions or psychographic profiles.
- 5Whether AIQ took reasonable security measures to protect the personal information in its custody or control under PIPEDA and PIPA.
- 6Whether the security breach involving the GitLab repository constituted a failure of reasonable security measures.
- 7Whether personal information collected from public telephone directories required consent.
- Consent for collection/use/disclosure: Failed to obtain adequate consent for US, UK, and Canadian campaigns
- Security safeguards: Failed to implement reasonable security measures
- Data breach: Login credentials exposed, personal information of 35 million people at risk
- Remedial action for security: Security issue resolved through AIQ's actions
- Overall complaint outcome: Well-founded-conditionally-resolved based on AIQ's commitments
- Future compliance: AIQ committed to implementing recommendations with follow-up
Well-founded-conditionally-resolved
AIQ failed to ensure adequate consent for various campaigns and failed to implement reasonable security measures. However, AIQ committed to implementing recommendations and took steps to remedy the security breach, leading to a conditional resolution.
AIQ was recommended to take reasonable measures to ensure adequate third-party consent, ensure express consent for sensitive or unexpected uses, adopt and maintain reasonable security measures, and delete personal information no longer necessary for business or legal purposes.
- Principle 4.3 PIPEDA
- Principle 4.3.2 PIPEDA
- Principle 4.3.4 PIPEDA
- Principle 4.3.5 PIPEDA
- Principle 4.3.6 PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- s.11(2) PIPEDA
- s.7(1)(d) PIPEDA
- s.7(2)(c.1) PIPEDA
- s.7(3)(h.1) PIPEDA
- Paragraph 1(a) of the Regulations Specifying Publicly Available Information
- s.3(1) PIPA
- s.6 PIPA
- s.12(2) PIPA
- s.15(2) PIPA
- s.18(2) PIPA
- s.34 PIPA
- s.35 PIPA
- s.36(1)(a) PIPA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro