Federal (Canada) Privacy Decisions

A complainant alleged that his Internet Service Provider (ISP) disclosed his personal information without consent to a newspaper columnist who was assisting him with a service dispute. The ISP argued it had implied consent due to the complainant's actions. The OPC found that the complainant's familiarity with the columnist and his own disclosure of information in his email to the columnist created a reasonable expectation that his information might be shared to resolve the dispute. The disclosed information was also found to be relevant and not sensitive.

• Was there implied consent for the disclosure of personal information to a columnist assisting with a dispute?
• Was the disclosed information relevant to the complaint?
• Was the disclosed information sensitive?

A customer complained that his investment firm's Know Your Client (KYC) form required an unreasonable amount of personal information, contrary to PIPEDA. The firm argued the information was necessary to comply with regulatory obligations set by the Investment Industry Regulatory Organization of Canada (IIROC). The OPC investigated whether the firm collected more information than necessary for legitimate purposes. Ultimately, the OPC found that the firm's collection of detailed financial and personal information, including spousal income and investment experience, was justified to meet IIROC's KYC and suitability requirements.

• Whether the investment firm explicitly specified the purposes for collecting personal information.
• Whether the stated purposes for collection were legitimate.
• Whether the firm collected more personal information than necessary to fulfill those purposes.
• Whether the collection was a condition of service that violated PIPEDA.