Federal (Canada) privacy & access decisions

A complainant alleged that his Internet service provider (ISP) disclosed his personal information without consent to a newspaper columnist. The complainant had contacted the columnist for assistance in resolving a service dispute with the ISP. The ISP argued it had implied consent to disclose information relevant to the dispute. The OPC found that the personal information disclosed was not sensitive and that, given the complainant's actions and familiarity with the columnist's work, it was reasonable for the ISP to infer implied consent. The ISP also limited its disclosure to information relevant to the complaint. Therefore, the OPC concluded that the complaint was not well-founded.

• Whether the ISP had the complainant's consent to disclose information to the newspaper columnist
• Whether the personal information disclosed was sensitive
• Whether implied consent was appropriate in the circumstances
• Whether the ISP limited its disclosure to relevant information

A customer complained that his investment firm required an unreasonable amount of personal information on its "Know Your Client" (KYC) form as a condition for maintaining his Tax Free Savings Account (TFSA) and Registered Retirement Savings Plan (RRSP). The firm requested details such as investment experience, annual income, spouse's income, dependents, assets, liabilities, and net worth. The firm argued this information was necessary to comply with the Investment Industry Regulatory Organization of Canada (IIROC) KYC and suitability requirements. The OPC assessed whether the firm contravened PIPEDA Principle 4.3.3 by requiring consent for information beyond explicitly specified and legitimate purposes. The OPC found that the firm had explicitly specified its purposes, which were legitimate given IIROC's regulatory framework. The OPC also concluded that the requested information, including details beyond IIROC's standard Form 2, was necessary for the firm to meet its regulatory obligations. Therefore, the complaint was not well-founded.

• Whether the investment firm explicitly specified the purposes for collecting personal information under Principle 4.2 PIPEDA
• Whether the purposes for collecting personal information were legitimate under subsection 5(3) PIPEDA
• Whether the investment firm required more personal information than necessary to achieve the legitimate purposes as a condition of service under Principle 4.3.3 PIPEDA
• Whether the collection of personal information was limited to that which was necessary for the identified purposes under Principle 4.4 PIPEDA
• Whether information on investment experience was necessary to validate investment knowledge and assess risk tolerance
• Whether spouse's or partner's annual income was necessary to assess overall financial position and suitability
• Whether detailed assets and liabilities were necessary to establish net worth and understand financial situation