DND breached the Privacy Act in disclosing the identity of a workplace violence complainant who had an expectation of confidentiality
An individual complained that the Department of National Defence (DND) breached the Privacy Act by disclosing their identity as a workplace violence (WPV) complainant to an investigator conducting a separate administrative investigation into the complainant's conduct. DND argued the disclosure was a "consistent use" under paragraph 8(2)(a) of the Privacy Act, necessary to address allegations against the individual. The OPC found that while disclosure to labour relations was a consistent use, disclosure to the investigator was not, as the consent form created a reasonable expectation of confidentiality for the WPV complaint. The OPC concluded that the disclosure to the investigator was not directly connected to the original purpose of collecting the WPV complaint information. DND committed to implementing recommendations to ensure future disclosures align with participants' reasonable expectations.
- 1Whether the disclosure of the WPV complainant's identity to labour relations was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
- 2Whether the disclosure of the WPV complainant's identity to an investigator for a separate administrative investigation was a "consistent use" under paragraph 8(2)(a) of the Privacy Act
- 3Whether the consent form provided by DND created a reasonable expectation of confidentiality regarding the complainant's identity
- Disclosure of identity: Disclosure to investigator was not a consistent use
- Consistent use (labour relations): Disclosure to labour relations was a consistent use
- Remedial action: Institution committed to implementing recommendations
Complaint well-founded and conditionally resolved
The OPC found that DND's disclosure of the complainant's identity to an investigator for a separate administrative investigation was not a "consistent use" under the Privacy Act, as it fell outside the reasonable expectations of confidentiality established by the consent form. However, DND committed to implementing the OPC's recommendations, leading to a conditionally resolved outcome.
The OPC recommended that DND ensure future disclosures of personal information in WPV processes align with participants' reasonable expectations and review/modify related tools and products within nine months. DND accepted these recommendations.
- paragraph 8(2)(a) Privacy Act
- subsection 20.9(3) COHSR
- paragraph 20.9(5)(b) COHSR
- subsection 20.9(4) COHSR
- subsection 20.9(5)(c) COHSR
- paragraph 11(1)(a)(iv) Privacy Act
- subsection 9(4) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro