Investigation into the treatment by a government institution of the personal information of two employees with the same name
An employee complained that her personal information was repeatedly disclosed to another employee with the same name, and that numerous administrative errors occurred in their respective files. The OPC found that the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant's personal information, including her PRI, email, mailing address, and financial and health information. It also contravened subsection 6(2) of the Act by failing to ensure the accuracy of personal information used for administrative purposes, leading to errors in employee files. The OPC concluded that these issues were systemic due to human error and a lack of awareness among employees regarding privacy breach reporting procedures. The institution accepted the OPC's recommendations to prevent unauthorized disclosures and ensure data accuracy, leading to a conditionally resolved finding.
- 1Whether the government institution contravened section 8 of the Privacy Act by mistakenly disclosing the complainant’s personal information to another employee with the same name
- 2Whether the government institution contravened subsection 6(2) of the Privacy Act by failing to ensure that personal information used for administrative purposes was accurate, up-to-date, and complete
- 3Whether the repeated disclosures and inaccuracies constituted a systemic problem
- 4Whether the institution's assessment of the sensitivity of the disclosed information was appropriate
- Unauthorized disclosure: Contravention of s.8 Privacy Act
- Accuracy of personal information: Contravention of s.6(2) Privacy Act
- Systemic issues: Identified human error and lack of awareness
- Recommendations: Institution accepted recommendations
- Resolution: Conditionally resolved finding
Complaint well-founded and conditionally resolved
The OPC found that the institution repeatedly disclosed personal information in error and failed to ensure the accuracy of information used for administrative purposes. The institution accepted the OPC's recommendations and committed to taking corrective actions, leading to a conditionally resolved outcome.
The OPC recommended that the government institution provide results of incident assessments, outline concrete measures to prevent unauthorized disclosures and ensure data accuracy, and confirm that a reminder about reporting privacy breaches was sent to all areas.
- s.8 Privacy Act
- s.6(2) Privacy Act
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro