Federal (Canada) Privacy Decisions

This investigation concerned the handling of personal information collected by the RCMP's Canadian Firearms Program and used by EKOS Research Associates Inc. to survey firearms licensees. The OPC found that the RCMP was authorized to collect the information for program administration and that its use for a client-satisfaction survey was consistent with the original purpose. The RCMP also complied with the Act in providing data to EKOS, as the contract included strong confidentiality provisions. As a result, the complaint was not well-founded.

• Lawful collection of personal information for program administration
• Use of personal information for client-satisfaction surveys
• Compliance with contractual confidentiality and security provisions
• Adequacy of privacy impact assessments

An individual complained that the Canada Border Services Agency (CBSA) improperly collected personal information from his blog after his term position ended. The complainant posted information on the internet for public consumption. The investigation found that some CBSA employees had viewed the blog from government computers in a personal capacity, which was deemed to accord with the government's Acceptable Use Policy. The investigation found no evidence that the CBSA had collected personal information in connection with these visits.

• Whether the CBSA collected personal information from an individual's public blog.
• Whether employee access to the blog from government computers was in accordance with policy.

A public servant complained that Public Works and Government Services Canada (PWGSC) failed to provide her with access to her personal information, collected during an investigation under the Public Servants Disclosure Protection Act. Although the investigation completely exonerated her, she was not informed of this outcome. The Office found that while PWGSC correctly applied section 22.3 of the Privacy Act to refuse disclosure, it urged the department to inform subjects when allegations are unsubstantiated. The Commissioner also asked the Treasury Board Secretariat to develop mechanisms for departments to inform individuals of unsubstantiated allegations.

• Access to personal information collected during a whistleblower investigation
• Application of section 22.3 of the Privacy Act
• Obligation to inform individuals when allegations of wrongdoing are unsubstantiated

This investigation examined a complaint regarding the Royal Canadian Mounted Police's (RCMP) use and disclosure of personal information from the Canadian Firearms Program (CFP) database to a public opinion research firm, EKOS Research Associates Inc. The RCMP contracted EKOS to conduct a survey of firearms licensees to improve program administration and service delivery. The investigation reviewed the contract, security measures, and the survey process.

• Appropriateness of using personal information for a client-satisfaction survey.
• Compliance with contractual confidentiality and security provisions when disclosing information to a third-party contractor.
• Whether the use of information for the survey was consistent with the purpose for which it was originally collected.

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless Internet connection to post messages to a website during an investigation. The Office found no evidence that the CHRC accessed the complainant's connection or collected any of her personal information. Technological experts suggested the association of the complainant's IP address to the CHRC was likely a mismatch by a third party.

• Whether the CHRC improperly collected and used the complainant's personal information by accessing her Internet connection.
• Whether an IP address constitutes personal information.
• Evidence of unauthorized access to personal information.

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information, alleging the CHRC accessed her wireless internet connection to post messages on a website. The investigation examined whether the CHRC contravened sections 4 to 8 of the Privacy Act. Ultimately, the OPC found no evidence that the CHRC collected or used the complainant's personal information, concluding the complaint was not well-founded.

• Whether the IP address constitutes personal information under the Privacy Act.
• Whether the CHRC collected and used the complainant's personal information during its investigations.
• Whether the CHRC improperly disclosed or retained the complainant's personal information.