Federal (Canada) privacy & access decisions

An individual complained that a telecommunications company continued to report a debt to a credit-reporting agency and that a collection agency was still contacting her, despite the debt being discharged in bankruptcy years prior. This inaccurate reporting was hindering her ability to rebuild her credit score. The telecommunications company investigated and found that an internal manual process error had caused the information to be overlooked. The company subsequently corrected its records, notified the credit-reporting agency of the updated information, and ensured that all collection activities against the complainant would cease. The complainant expressed satisfaction with the resolution.

• Whether the telecommunications company maintained sufficiently accurate personal information (Principle 4.6 PIPEDA)
• Whether the telecommunications company appropriately disclosed accurate personal information to a third party (Principle 4.6 PIPEDA)

An individual complained to the OPC after a retailer's delivery person inappropriately texted her using her phone number, which he had transferred from his faulty work phone to his personal device. The complainant also felt the retailer's management initially showed a lack of concern. The OPC's inquiries revealed the delivery person obtained the customer's number from his work phone. The retailer, disapproving of employees transferring customer information to personal devices, subsequently implemented a new policy requiring delivery employees with faulty work phones to return to the warehouse immediately. The retailer also took disciplinary action against the delivery person, provided mandatory privacy retraining to employees, and the company president met personally with the affected customer. The customer was satisfied with the actions taken by the retailer.

• Whether the delivery person's use of customer information for personal communication was appropriate
• Whether the retailer adequately protected customer personal information when work devices were faulty
• Whether the retailer responded appropriately to the customer's complaint

An individual complained that a car dealership could not provide details about its personal information handling practices. The complainant was asked for her driver's license and credit card for a loaner car, and when she inquired about the collection and safeguards, the employee could not provide satisfactory answers. Her subsequent email to the dealership's privacy officer also went unanswered. The OPC conducted a site visit and reviewed the dealership's policies and practices, finding them satisfactory. However, the OPC emphasized the need for employees to be knowledgeable about these practices. The dealership agreed to conduct a review session for its employees. The complainant was satisfied with the outcome, and the matter was early resolved.

• Whether the car dealership provided sufficient details about its personal information handling practices upon request
• Whether the car dealership's employees were adequately trained to answer questions about personal information collection, safeguards, and retention

An individual complained that a collection agency was pursuing him for a debt he did not owe, which was negatively impacting his credit report. The individual alleged that the agency had been calling him for years and disclosed his financial information to his household members. He also claimed he was denied access to documentation validating the debt. The OPC contacted the collection agency, which then investigated the matter after discrepancies were noted in the original credit application. The agency ceased debt collection, acknowledged possible fraud, and committed to correcting the individual's credit report. The individual was satisfied with this resolution.

• Whether the collection agency ensured the accuracy of personal information used for debt collection (Principle 4.5 PIPEDA)
• Whether the collection agency provided the individual with access to his personal information (Principle 4.9 PIPEDA)
• Whether the collection agency disclosed personal financial information to third parties without consent (Principle 4.3 PIPEDA)

A customer complained to the OPC after noticing a department store publicly displaying photographs of individuals, asking for information about them. The store claimed police and legal counsel advised this practice was permissible for alleged shoplifters. The OPC disagreed, explaining that publicly disclosing personal information (photographs) without consent is not allowed under PIPEDA. The store agreed to remove the pictures and discontinue the practice, opting to deal with police directly for such matters. The complainant was satisfied with this resolution.

• Whether publicly displaying photographs of suspected shoplifters without consent constitutes an unauthorized disclosure of personal information under PIPEDA
• Whether photographs of individuals recorded on video surveillance are considered personal information under PIPEDA

A couple received fraudulent calls from someone posing as an anti-virus service provider technician, who gained remote access to their computer and processed a fraudulent credit card payment. The fraudster used the couple's private account number, which they believed was obtained from the legitimate service provider. The couple struggled to get the service provider to investigate the matter, leading them to file a complaint with the OPC. The OPC requested the service provider conduct an investigation, which revealed an employee had improperly accessed the complainant's account. The employee was dismissed, and the service provider reimbursed the couple and implemented new safeguards, including an auditing system for employee access and a streamlined procedure for escalating privacy concerns. The complainants were satisfied with these outcomes.

• Whether the anti-virus service provider adequately protected personal information against unauthorized access by employees (Principle 4.7 PIPEDA)
• Whether the anti-virus service provider had adequate procedures to receive and respond to complaints about personal information handling (Principle 4.10 PIPEDA)
• Whether the anti-virus service provider adequately investigated the complaint (Principle 4.10.4 PIPEDA)

An employee of a credit union complained that her manager accessed her personal financial information without consent. The manager suspected the employee had falsely called in sick and checked her bank account transactions to see if she had used her debit card out of province. The employee discovered this when her employment was terminated and the manager referenced the incident. After receiving an inconclusive response from the credit union, she filed a complaint with the OPC. The OPC initiated its early resolution process, and the credit union acknowledged the manager's actions were without a valid business purpose and constituted an unauthorized use of personal information. The credit union committed to addressing the issue with the manager and sent a letter of apology to the employee. The employee was satisfied with this resolution.

• Whether a manager accessing an employee's personal bank account without a valid business purpose constitutes unauthorized use of personal information under PIPEDA
• Whether the credit union's actions to address the manager's conduct and apologize to the employee were satisfactory for early resolution

An individual complained after receiving a promotional phone call from a hotel chain shortly after visiting its website, suspecting the hotel linked her IP address to her phone number. The hotel chain denied making such calls or collecting her personal information, stating the call was part of a telemarketing scam by an unrelated party. The OPC's investigation confirmed the calls were indeed a scam. The complainant suggested the hotel warn its customers, which the hotel did. The matter was resolved through the OPC's early resolution process.

• Whether the hotel chain collected the complainant's personal information (phone number) from her website visit
• Whether the promotional phone call originated from the hotel chain or an unrelated third party

An office building tenant complained about five video surveillance cameras installed in a shared common area by another tenant, a call centre company. The complainant found it disturbing that the cameras recorded his and his clients' movements, particularly two cameras positioned between his office, the washrooms, and the elevators. The installing tenant claimed the cameras were for safety following a security incident and that building management had authorized their installation. After the OPC became involved, the building management facilitated the relocation of the two most concerning cameras from the shared hallway into the installing tenant's offices. The complainant expressed satisfaction that his and his clients' privacy rights were now respected. The case was resolved early.

• Whether the installation of video surveillance cameras in a shared common area by one tenant infringed on the privacy of another tenant and their clients
• Whether the collection of personal information via video surveillance was appropriate and proportionate to the stated safety purpose
• Whether consent was obtained for the video surveillance