Accidental disclosure by Health Canada - March 3, 2015
The Office of the Privacy Commissioner (OPC) initiated a complaint against Health Canada (HC) after HC sent 41,514 letters to "Marihuana Medical Access Program" (MMAP) clients in windowed envelopes that allowed the program name to be openly visible. The OPC also received 339 individual complaints regarding this incident. Complainants were concerned that the visible program name revealed their association with MMAP to Canada Post employees and the public, potentially impacting their careers, reputation, and safety due to the stigma associated with marihuana. HC argued that the disclosure was implicitly consented to, was a consistent use of information, or was not an unlawful disclosure by HC. The OPC found that the combination of the MMAP name and the individual's name and address constituted sensitive personal information. HC failed to demonstrate appropriate consent or that any permissible disclosures under section 8(2) of the Privacy Act applied. The OPC concluded that HC contravened the Privacy Act.
- 1Whether the phrase "Marihuana Medical Access Program" combined with an individual's name and address constitutes personal information under section 3 of the Privacy Act
- 2Whether subsequent actions by individuals (e.g., media communication) alter Health Canada's obligations under the Privacy Act
- 3Whether mail recipients implicitly consented to the disclosure of their personal information under section 8(1) of the Privacy Act
- 4Whether the disclosure was a "consistent use" under section 8(2)(a) of the Privacy Act
- 5Whether limiting information on return address blocks would have broad implications for government communication
- Disclosure of personal information: Disclosure of program name on envelopes constituted a contravention of the Privacy Act
- Consent for disclosure: Institution failed to demonstrate appropriate consent
- Permissible disclosure: Institution failed to demonstrate permissible disclosure under s.8(2)
- Nature of information: Program name combined with individual's name and address deemed sensitive personal information
Complaint well-founded — Health Canada contravened the Privacy Act
The OPC found that the visible program name constituted sensitive personal information and Health Canada failed to demonstrate appropriate consent or that any permissible disclosures under section 8(2) of the Privacy Act applied. The disclosure was deemed an administrative error and a departure from usual practices.
The OPC encouraged Health Canada to follow its new procedures for managing mail-outs to safeguard clients' sensitive personal information and minimize the risk of unauthorized disclosure.
- s.3 Privacy Act
- s.8(1) Privacy Act
- s.8(2)(a) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro