PIPEDA Findings #2021-009: Opt-in consent required for a donor list trading program
A complainant alleged that a charitable organization (the Respondent) failed to obtain proper consent before sharing his personal information through a donor list trading program. The Respondent used an opt-out checkbox on its mail-in donation forms, which the complainant found inadequate after receiving solicitations from another charity. The OPC determined that sharing donor information with other charities for solicitation purposes was outside the reasonable expectations of donors, thus requiring express opt-in consent. Furthermore, the information provided by the Respondent on its donation forms, inserts, and privacy policy was deemed insufficient to enable meaningful consent. The OPC recommended that the Respondent obtain express opt-in consent and enhance its privacy communications to clearly explain the nature, purpose, and consequences of the data sharing. The Respondent agreed to implement these recommendations, leading to a conditionally resolved outcome.
- 1Whether the Respondent obtained meaningful consent for its donor list trading program under PIPEDA
- 2Whether opt-out consent was appropriate for sharing donor information with third parties
- 3Whether the information shared (donor name, address, donation status) was sensitive in this context
- 4Whether sharing donor information with other charities for solicitation was within the reasonable expectations of donors
- 5Whether the donor list trading program created a meaningful residual risk of significant harm
- 6Whether the information provided to donors on the donation form, insert, and privacy policy was sufficient to support meaningful consent
- Consent for data sharing: Opt-out consent deemed inadequate
- Information for consent: Privacy communications deemed insufficient
- Recommendation for consent: Express opt-in consent recommended
- Recommendation for transparency: Enhanced privacy communications recommended
- Outcome of complaint: Conditionally resolved
Complaint well-founded and conditionally resolved
The OPC found that sharing donor information for a list trading program was outside donors' reasonable expectations, necessitating express opt-in consent, which the Respondent failed to obtain. Additionally, the information provided to donors was insufficient to ensure meaningful consent.
The OPC recommended that the Respondent implement express opt-in consent for its donor list trading program and amend its privacy communications to provide key information upfront, including what information is shared, with whom, for what purpose, and how to withdraw consent.
- Principle 4.3 PIPEDA
- s.4.3.2 PIPEDA
- s.4.3.4 PIPEDA
- s.4.3.5 PIPEDA
- s.4.3.6 PIPEDA
- s.4.3.7 PIPEDA
- s.6.1 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro