PIPEDA Report of Findings #2016-005: Joint investigation of Ashley Madison by the Privacy Commissioner of Canada and the Australian Privacy Commissioner/Acting Australian Information Commissioner
The Office of the Privacy Commissioner of Canada (OPC) and the Office of the Australian Information Commissioner (OAIC) jointly investigated Avid Life Media Inc. (ALM), operator of the Ashley Madison dating website, following a massive data breach in 2015 that exposed approximately 36 million user accounts. The investigation focused on ALM's information handling practices, including its security safeguards, data retention policies, email address accuracy, and transparency with users. The OPC found multiple contraventions of PIPEDA, concluding that ALM lacked an adequate security framework, retained personal information indefinitely, charged a fee for account deletion, and failed to ensure the accuracy of email addresses. Furthermore, ALM's use of a deceptive "trusted security award" trust-mark and unclear retention policies invalidated user consent. ALM agreed to implement all recommendations, leading to a "well-founded and conditionally resolved" outcome, and entered into a compliance agreement with the OPC. Corrective measures included enhancing security, revising retention periods, offering free deletion, and improving transparency.
- 1Whether ALM's security safeguards were appropriate to the sensitivity of the information under PIPEDA Principle 4.7.
- 2Whether ALM implemented policies and practices to give effect to the Principles, including procedures to protect personal information, under PIPEDA Principle 4.1.4.
- 3Whether ALM's indefinite retention of personal information for deactivated or inactive accounts contravened PIPEDA Principle 4.5.
- 4Whether ALM's failure to establish maximum retention periods for personal information contravened PIPEDA Principle 4.5.2.
- 5Whether ALM's practice of charging a fee for the complete deletion of personal information contravened an individual's right to withdraw consent under PIPEDA Principle 4.3.8.
- 6Whether ALM took reasonable steps to ensure personal information (email addresses) was accurate, complete, and up-to-date as necessary for its purposes, taking into account the interests of the individual, under PIPEDA Principle 4.6 and 4.6.1.
- 7Whether ALM's consent for the collection, use, or disclosure of personal information was valid, given the nature, purpose, and consequences, under PIPEDA s.6.1 and Principle 4.3.
- 8Whether ALM made information about its personal information handling policies and practices readily available and understandable, and did not obtain consent through deception, under PIPEDA Principle 4.8, 4.8.1, and 4.3.5.
- Security safeguards: Contravention found, improvements ordered
- Data retention: Contravention found, revisions ordered
- Account deletion fee: Contravention found, free deletion ordered
- Email address accuracy: Contravention found, improvements ordered
- Transparency/Consent: Contravention found, improvements ordered
- Overall complaint outcome: Well-founded and conditionally resolved
Well-founded and conditionally resolved
The OPC found that ALM contravened multiple PIPEDA principles across several key areas of its information handling practices, but ALM committed to implementing all recommendations and entered into a compliance agreement with the OPC.
ALM agreed to implement all recommendations, including conducting a comprehensive review of protections, augmenting its security framework, documenting processes, providing staff training, submitting independent third-party reports, ceasing indefinite retention, determining appropriate retention periods, implementing retention schedules, continuing to provide a no-cost deletion option, amending terms/policies for clarity, and reviewing representations for accuracy.
- s.11(2) PIPEDA
- Principle 4.7 PIPEDA
- Principle 4.7.1 PIPEDA
- Principle 4.1.4 PIPEDA
- Principle 4.5 PIPEDA
- Principle 4.5.2 PIPEDA
- Principle 4.5.3 PIPEDA
- Principle 4.3.8 PIPEDA
- Principle 4.6 PIPEDA
- Principle 4.6.1 PIPEDA
- s.6.1 PIPEDA
- Principle 4.8 PIPEDA
- Principle 4.8.1 PIPEDA
- Principle 4.3 PIPEDA
- Principle 4.3.5 PIPEDA
- s.13(1)(a) PIPEDA
- s.17.1(1) PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro