Federal (Canada) privacy & access decisions

A condominium owner filed a complaint after his request for access to his personal information was met with a demand for payment for photocopies or an offer to view documents at the organization's lawyer's office. The individual argued that this was not access at "minimal or no cost" as required by PIPEDA Principle 4.9.4. The OPC's early resolution unit intervened, and the organization initially offered free viewing with the option to select pages for free copies. The complainant, citing a disability, found viewing 1000 pages unreasonable. The OPC proposed that the individual narrow his request, which he accepted. Consequently, the organization agreed to provide free copies of the specific documents containing his personal information, leading to the complainant's satisfaction.

• Whether the organization's initial response to an access request met the "minimal or no cost" requirement under Principle 4.9.4 of PIPEDA
• Whether an offer to view documents without free copies constitutes adequate access under PIPEDA
• Whether the organization's proposed solution of viewing documents at a lawyer's office was reasonable given the complainant's disability
• Whether narrowing the scope of an access request can facilitate resolution and compliance with PIPEDA

An individual complained to the OPC after an online service company failed to resolve a technical glitch that caused another person's personal information to appear in his account. Despite months of attempts, the company's customer service and IT specialists could not fix the issue, nor could the individual escalate his concerns to a privacy officer. The OPC intervened, prompting the company to investigate and discover the glitch originated from another organization's software interface. The online company, in collaboration with the other organization, corrected the technical glitch for all users. The online company also revised its internal policies to include an escalation process for privacy concerns and established a new contractual agreement with the other organization to prevent future issues and enhance PIPEDA compliance. The complainant confirmed the issue was resolved to his satisfaction.

• Whether an online service company adequately addressed a technical glitch leading to unauthorized disclosure of personal information
• Whether the online service company had appropriate internal policies for escalating privacy concerns
• Whether the online service company had adequate contractual agreements with third-party service providers regarding privacy and data breaches

An employee of a First Nation band council complained that two doctor's notes he submitted for leave requests were lost by the band office, leading to non-payment for his leave. The complainant also filed a complaint under the Canada Labour Code. The OPC's Early Resolution Unit engaged with the band council, which, while not confirming the loss of the notes, agreed to develop a privacy policy and adopt best privacy practices. The OPC provided resources to assist in this development. The complainant was satisfied with the band council's commitment to a privacy policy, leading to an early resolution of the privacy complaint, with the issue of lost notes to be addressed via the Canada Labour Code complaint. The band council subsequently adopted a privacy policy with the OPC's guidance.

• Whether a First Nation band council is a federal work, undertaking or business (FWUB) under PIPEDA
• Whether the personal information of employees of a FWUB is protected under PIPEDA
• Whether the First Nation band council adequately protected the complainant's medical information
• Whether the First Nation band council had appropriate privacy policies and practices in place