PIPEDA Report of Findings #2015-007: Financial institution takes strong remedial measures after insufficient safeguards and unnecessary storage leaves sensitive data vulnerable to breach
The OPC initiated an investigation into Peoples Trust following a data breach that compromised sensitive personal information of approximately 12,000 customers. The investigation found that Peoples Trust failed to implement adequate technological and organizational safeguards, including using an outdated and vulnerable web editor and lacking ongoing monitoring. Additionally, the organization unnecessarily stored duplicate, unencrypted customer information on a web server for longer than required, contravening its retention policies. Following the OPC's intervention, Peoples Trust implemented comprehensive remedial measures, such as redesigning its web portal, enhancing monitoring, and developing a new Information Security Policy. As a result, the OPC concluded the matter was well-founded and resolved.
- 1Whether Peoples Trust implemented adequate technological and organizational safeguards appropriate to the sensitivity of the information, as per Principle 4.7 and 4.1.4(a) PIPEDA
- 2Whether Peoples Trust retained personal information for longer than necessary to fulfill its purposes, as per Principle 4.5 PIPEDA
- Adequacy of safeguards: Organization failed to implement adequate safeguards
- Data retention: Organization unnecessarily stored unencrypted data
- Resolution of complaint: Complaint found well-founded and resolved
Complaint well-founded and resolved
The OPC found that Peoples Trust contravened PIPEDA Principles 4.7, 4.1.4(a), and 4.5 due to inadequate safeguards and unnecessary data retention. However, the organization took timely and comprehensive remedial actions to address the identified issues to the OPC's satisfaction.
Peoples Trust implemented a comprehensive strategy to mitigate risk to affected individuals, ceased unnecessary retention of personal information, enhanced safeguards for its web portal, and developed more robust procedures for privacy-protective practices.
- Principle 4.1.4 PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.5.2 PIPEDA
- Principle 4.5.3 PIPEDA
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- Principle 4.7.2 PIPEDA
- Principle 4.7.3 PIPEDA
This summary is for informational purposes only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro