Federal (Canada) privacy & access decisions

An individual complained after an insurance company refused to provide access to her personal information following an incident at a store. The individual sought access to her insurance claim file, including case management notes and a video of the incident. The company initially refused, citing confidential commercial information and the personal information of third parties. Through the OPC's early resolution process, the company agreed to allow the individual to view the video and provided a redacted copy of the case management notes. The OPC's Early Resolution Officer reviewed the redactions to ensure they were properly applied. The complaint was resolved to the satisfaction of both parties.

• Whether an organization must provide an individual with access to their personal information upon request
• Whether case management notes constitute "confidential commercial information" under PIPEDA paragraph 9(3)(b)
• Whether a video containing images of third parties can be withheld from an access request
• Whether an organization can fulfill its access obligations by allowing viewing of a record rather than providing a copy
• Whether redaction of confidential commercial information or third-party personal information is an appropriate method to grant access

A complainant sought to open an online financial investment account with a FinTech organization. To access the investment account management agreement, the complainant was required to provide personal information, some of which was sensitive. After reviewing the agreement, the complainant decided not to open an account and requested deletion of their personal information. The organization cited "regulatory requirements" for the collection. The OPC clarified that while regulatory requirements exist, they apply once an individual becomes a client, not before. The OPC advised the organization to revise its website so prospective clients could review the agreement without prior personal information disclosure. The organization agreed to revise its website and Privacy Policy, leading to an early resolution.

• Whether a FinTech organization can require personal information before a prospective client reviews terms and conditions
• Whether consent under PIPEDA is meaningful if personal information is collected before a user can review service agreements
• Whether regulatory requirements justify collecting personal information from prospective clients who do not proceed with opening an account

An individual complained that a bank performed numerous credit checks on her without consent, despite her not being a client for many years. The bank initially claimed the inquiries were from its marketing group and not visible to other organizations, but its internal investigation revealed they were 'soft hits' related to inactive accounts from 2013. The bank's privacy policy stated it retained the ability to perform credit inquiries after a service ended, but the OPC expressed concern over the continued collection of sensitive credit information without a legal requirement. To resolve the complaint, the bank agreed to cease this practice and update its privacy policy. The complainant was satisfied, and the matter was early resolved.

• Whether a bank can continue to perform credit checks on former clients without their consent
• Whether the bank's privacy policy adequately justified continued credit inquiries after the termination of a business relationship
• Whether the bank provided accurate information to the complainant regarding the source and nature of the credit inquiries

A condominium owner filed a complaint after his request for access to his personal information was met with a demand for payment for photocopies or an offer to view documents at the organization's lawyer's office. The individual argued that this was not access at "minimal or no cost" as required by PIPEDA Principle 4.9.4. The OPC's early resolution unit intervened, and the organization initially offered free viewing with the option to select pages for free copies. The complainant, citing a disability, found viewing 1000 pages unreasonable. The OPC proposed that the individual narrow his request, which he accepted. Consequently, the organization agreed to provide free copies of the specific documents containing his personal information, leading to the complainant's satisfaction.

• Whether the organization's initial response to an access request met the "minimal or no cost" requirement under Principle 4.9.4 of PIPEDA
• Whether an offer to view documents without free copies constitutes adequate access under PIPEDA
• Whether the organization's proposed solution of viewing documents at a lawyer's office was reasonable given the complainant's disability
• Whether narrowing the scope of an access request can facilitate resolution and compliance with PIPEDA

An individual complained to the OPC after an online service company failed to resolve a technical glitch that caused another person's personal information to appear in his account. Despite months of attempts, the company's customer service and IT specialists could not fix the issue, nor could the individual escalate his concerns to a privacy officer. The OPC intervened, prompting the company to investigate and discover the glitch originated from another organization's software interface. The online company, in collaboration with the other organization, corrected the technical glitch for all users. The online company also revised its internal policies to include an escalation process for privacy concerns and established a new contractual agreement with the other organization to prevent future issues and enhance PIPEDA compliance. The complainant confirmed the issue was resolved to his satisfaction.

• Whether an online service company adequately addressed a technical glitch leading to unauthorized disclosure of personal information
• Whether the online service company had appropriate internal policies for escalating privacy concerns
• Whether the online service company had adequate contractual agreements with third-party service providers regarding privacy and data breaches

An employee of a First Nation band council complained that two doctor's notes he submitted for leave requests were lost by the band office, leading to non-payment for his leave. The complainant also filed a complaint under the Canada Labour Code. The OPC's Early Resolution Unit engaged with the band council, which, while not confirming the loss of the notes, agreed to develop a privacy policy and adopt best privacy practices. The OPC provided resources to assist in this development. The complainant was satisfied with the band council's commitment to a privacy policy, leading to an early resolution of the privacy complaint, with the issue of lost notes to be addressed via the Canada Labour Code complaint. The band council subsequently adopted a privacy policy with the OPC's guidance.

• Whether a First Nation band council is a federal work, undertaking or business (FWUB) under PIPEDA
• Whether the personal information of employees of a FWUB is protected under PIPEDA
• Whether the First Nation band council adequately protected the complainant's medical information
• Whether the First Nation band council had appropriate privacy policies and practices in place

An individual complained that a telecommunications company continued to report a debt to a credit-reporting agency and that a collection agency was still contacting her, despite the debt being discharged in bankruptcy years prior. This inaccurate reporting was hindering her ability to rebuild her credit score. The telecommunications company investigated and found that an internal manual process error had caused the information to be overlooked. The company subsequently corrected its records, notified the credit-reporting agency of the updated information, and ensured that all collection activities against the complainant would cease. The complainant expressed satisfaction with the resolution.

• Whether the telecommunications company maintained sufficiently accurate personal information (Principle 4.6 PIPEDA)
• Whether the telecommunications company appropriately disclosed accurate personal information to a third party (Principle 4.6 PIPEDA)

An individual complained to the OPC after a retailer's delivery person inappropriately texted her using her phone number, which he had transferred from his faulty work phone to his personal device. The complainant also felt the retailer's management initially showed a lack of concern. The OPC's inquiries revealed the delivery person obtained the customer's number from his work phone. The retailer, disapproving of employees transferring customer information to personal devices, subsequently implemented a new policy requiring delivery employees with faulty work phones to return to the warehouse immediately. The retailer also took disciplinary action against the delivery person, provided mandatory privacy retraining to employees, and the company president met personally with the affected customer. The customer was satisfied with the actions taken by the retailer.

• Whether the delivery person's use of customer information for personal communication was appropriate
• Whether the retailer adequately protected customer personal information when work devices were faulty
• Whether the retailer responded appropriately to the customer's complaint

An individual complained that a car dealership could not provide details about its personal information handling practices. The complainant was asked for her driver's license and credit card for a loaner car, and when she inquired about the collection and safeguards, the employee could not provide satisfactory answers. Her subsequent email to the dealership's privacy officer also went unanswered. The OPC conducted a site visit and reviewed the dealership's policies and practices, finding them satisfactory. However, the OPC emphasized the need for employees to be knowledgeable about these practices. The dealership agreed to conduct a review session for its employees. The complainant was satisfied with the outcome, and the matter was early resolved.

• Whether the car dealership provided sufficient details about its personal information handling practices upon request
• Whether the car dealership's employees were adequately trained to answer questions about personal information collection, safeguards, and retention

An individual complained that a collection agency was pursuing him for a debt he did not owe, which was negatively impacting his credit report. The individual alleged that the agency had been calling him for years and disclosed his financial information to his household members. He also claimed he was denied access to documentation validating the debt. The OPC contacted the collection agency, which then investigated the matter after discrepancies were noted in the original credit application. The agency ceased debt collection, acknowledged possible fraud, and committed to correcting the individual's credit report. The individual was satisfied with this resolution.

• Whether the collection agency ensured the accuracy of personal information used for debt collection (Principle 4.5 PIPEDA)
• Whether the collection agency provided the individual with access to his personal information (Principle 4.9 PIPEDA)
• Whether the collection agency disclosed personal financial information to third parties without consent (Principle 4.3 PIPEDA)

A customer complained to the OPC after noticing a department store publicly displaying photographs of individuals, asking for information about them. The store claimed police and legal counsel advised this practice was permissible for alleged shoplifters. The OPC disagreed, explaining that publicly disclosing personal information (photographs) without consent is not allowed under PIPEDA. The store agreed to remove the pictures and discontinue the practice, opting to deal with police directly for such matters. The complainant was satisfied with this resolution.

• Whether publicly displaying photographs of suspected shoplifters without consent constitutes an unauthorized disclosure of personal information under PIPEDA
• Whether photographs of individuals recorded on video surveillance are considered personal information under PIPEDA

A couple received fraudulent calls from someone posing as an anti-virus service provider technician, who gained remote access to their computer and processed a fraudulent credit card payment. The fraudster used the couple's private account number, which they believed was obtained from the legitimate service provider. The couple struggled to get the service provider to investigate the matter, leading them to file a complaint with the OPC. The OPC requested the service provider conduct an investigation, which revealed an employee had improperly accessed the complainant's account. The employee was dismissed, and the service provider reimbursed the couple and implemented new safeguards, including an auditing system for employee access and a streamlined procedure for escalating privacy concerns. The complainants were satisfied with these outcomes.

• Whether the anti-virus service provider adequately protected personal information against unauthorized access by employees (Principle 4.7 PIPEDA)
• Whether the anti-virus service provider had adequate procedures to receive and respond to complaints about personal information handling (Principle 4.10 PIPEDA)
• Whether the anti-virus service provider adequately investigated the complaint (Principle 4.10.4 PIPEDA)

An employee of a credit union complained that her manager accessed her personal financial information without consent. The manager suspected the employee had falsely called in sick and checked her bank account transactions to see if she had used her debit card out of province. The employee discovered this when her employment was terminated and the manager referenced the incident. After receiving an inconclusive response from the credit union, she filed a complaint with the OPC. The OPC initiated its early resolution process, and the credit union acknowledged the manager's actions were without a valid business purpose and constituted an unauthorized use of personal information. The credit union committed to addressing the issue with the manager and sent a letter of apology to the employee. The employee was satisfied with this resolution.

• Whether a manager accessing an employee's personal bank account without a valid business purpose constitutes unauthorized use of personal information under PIPEDA
• Whether the credit union's actions to address the manager's conduct and apologize to the employee were satisfactory for early resolution

An individual complained after receiving a promotional phone call from a hotel chain shortly after visiting its website, suspecting the hotel linked her IP address to her phone number. The hotel chain denied making such calls or collecting her personal information, stating the call was part of a telemarketing scam by an unrelated party. The OPC's investigation confirmed the calls were indeed a scam. The complainant suggested the hotel warn its customers, which the hotel did. The matter was resolved through the OPC's early resolution process.

• Whether the hotel chain collected the complainant's personal information (phone number) from her website visit
• Whether the promotional phone call originated from the hotel chain or an unrelated third party

An office building tenant complained about five video surveillance cameras installed in a shared common area by another tenant, a call centre company. The complainant found it disturbing that the cameras recorded his and his clients' movements, particularly two cameras positioned between his office, the washrooms, and the elevators. The installing tenant claimed the cameras were for safety following a security incident and that building management had authorized their installation. After the OPC became involved, the building management facilitated the relocation of the two most concerning cameras from the shared hallway into the installing tenant's offices. The complainant expressed satisfaction that his and his clients' privacy rights were now respected. The case was resolved early.

• Whether the installation of video surveillance cameras in a shared common area by one tenant infringed on the privacy of another tenant and their clients
• Whether the collection of personal information via video surveillance was appropriate and proportionate to the stated safety purpose
• Whether consent was obtained for the video surveillance