Federal (Canada) Privacy Decisions

This investigation concerned complaints against the CBC for disclosing details of a privacy breach at the Canada Revenue Agency (CRA), where taxpayer information was inadvertently sent to a CBC journalist. The CBC subsequently published an article containing some of this information, including names and photos of affected individuals. However, the OPC found that the Privacy Act does not apply to personal information collected, used, or disclosed by the CBC for journalistic purposes. Therefore, the complaints were deemed not well-founded as the information was excluded from the Act's application.

• Whether the CBC contravened the Privacy Act by disclosing personal information obtained from a privacy breach at the CRA.
• Whether section 69.1 of the Privacy Act, which excludes journalistic purposes from the Act's application, applied to the CBC's actions.
• Whether the CBC's use and disclosure of the personal information was for purely journalistic purposes.

A complainant alleged that his Internet Service Provider (ISP) disclosed his personal information without consent to a newspaper columnist who was assisting him with a service dispute. The ISP argued it had implied consent due to the complainant's actions. The OPC found that the complainant's familiarity with the columnist and his own disclosure of information in his email to the columnist created a reasonable expectation that his information might be shared to resolve the dispute. The disclosed information was also found to be relevant and not sensitive.

• Was there implied consent for the disclosure of personal information to a columnist assisting with a dispute?
• Was the disclosed information relevant to the complaint?
• Was the disclosed information sensitive?

A staff relations representative complained that the RCMP's disclosure of informal disciplinary records to the Crown was inconsistent with the Supreme Court’s McNeil decision. The complainant argued that only records from formal disciplinary hearings should be disclosed. The OPC agreed with the RCMP that all disciplinary records, informal or formal, may need to be disclosed if relevant to court proceedings. While the complaint was found not well-founded, the OPC recommended the RCMP reconsider its policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services.

• Disclosure of informal disciplinary records to the Crown in light of the McNeil decision
• Relevance determination for disclosure of disciplinary records
• Retention period for RCMP disciplinary records

This investigation concerned a complaint that the Canada Border Services Agency (CBSA) violated the Privacy Act by requiring border services officers (BSOs) to wear name tags displaying their surnames. Complainants argued this was an unreasonable invasion of privacy and exposed them to potential harm. The Office of the Privacy Commissioner of Canada (OPC) found that while the names were personal information, they fell under an exception in the Privacy Act relating to information about an individual's position or functions within a government institution. Therefore, the requirement to display surnames on name tags did not violate the Act.

• Whether displaying surnames on name tags constitutes personal information under the Privacy Act.
• Whether displaying surnames on name tags is an unreasonable invasion of privacy.
• Whether the requirement to display surnames on name tags violates the use and disclosure provisions of the Privacy Act.
• Whether the exception for information relating to an individual's position or functions applies to surnames on name tags.

A customer complained that his investment firm's Know Your Client (KYC) form required an unreasonable amount of personal information, contrary to PIPEDA. The firm argued the information was necessary to comply with regulatory obligations set by the Investment Industry Regulatory Organization of Canada (IIROC). The OPC investigated whether the firm collected more information than necessary for legitimate purposes. Ultimately, the OPC found that the firm's collection of detailed financial and personal information, including spousal income and investment experience, was justified to meet IIROC's KYC and suitability requirements.

• Whether the investment firm explicitly specified the purposes for collecting personal information.
• Whether the stated purposes for collection were legitimate.
• Whether the firm collected more personal information than necessary to fulfill those purposes.
• Whether the collection was a condition of service that violated PIPEDA.

A complainant expressed concern that the online publication of her full name and date of birth in the Canada Gazette, as required by the agreement establishing the Qalipu Mi’kmaq First Nation Band, put her at risk of identity theft. The Office of the Privacy Commissioner of Canada (OPC) investigated and found that the disclosure was consistent with the Privacy Act, as the information was published for the purpose for which it was originally collected: the identification and recognition of Band members. Therefore, the complaint was not well-founded.

• Disclosure of personal information without consent
• Purpose of collection and disclosure
• Risk of identity theft

A complainant challenged Canada Post's practice of checking credit information during an online change of address request, alleging a violation of the Privacy Act. The OPC investigated and found that while Canada Post uses Equifax for identity verification, it does not conduct a credit check. Although no contravention of the Act was found regarding the information sharing itself, the OPC recommended and Canada Post implemented clearer notifications to individuals about the sharing of their personal information with Equifax for identity verification purposes.

• Whether Canada Post contravened the Privacy Act by sharing personal information with Equifax for identity verification.
• Adequacy of notice provided to individuals regarding the disclosure of personal information to Equifax.
• Canada Post's statutory authority to collect personal information for the online change of address process.

A complainant alleged that personal information about a "boat refugee" who was a wanted fugitive was disclosed by a federal institution to a National Post reporter. The OPC investigated and found that the information in question was publicly available on the INTERPOL website. Due to journalistic confidentiality, the OPC could not confirm how the reporter obtained the information, but found no evidence that any of the named federal institutions had disclosed it. The complaint was therefore not well-founded, though the OPC reminded departments of the sensitivity of refugee information.

• Whether personal information of a refugee was disclosed by a federal institution to a reporter
• The source of information published by the National Post
• The sensitivity of personal information of refugees

The Office of the Privacy Commissioner of Canada investigated a complaint concerning the Public Service Commission of Canada's collection and disclosure of an individual's medical release information from the Canadian Forces. The information was used for a priority hiring program for ex-military staff. The investigation found that the complainant had consented to the collection and disclosure.

• Collection and disclosure of personal information
• Consent to collection and disclosure
• Use of personal information for priority hiring program

The Office of the Privacy Commissioner of Canada investigated a complaint from an individual who was asked to provide his driver's licence number to close his postal box with Canada Post. Canada Post stated this was necessary to prevent fraudulent activity and for investigations into illegal shipments. The OPC found Canada Post's collection of identification numbers to be reasonable and consistent with its mandate to provide secure postal services. The complaint was dismissed as not well-founded.

• Reasonableness of collecting driver's licence number for postal box closure.
• Consistency of collection with Canada Post's mandate and security requirements.
• Purpose of collecting personal information.

The Minister of Agriculture and Agri-Food Canada filed a privacy complaint against the Canadian Wheat Board (CWB) in November 2009, following media reports about an internal audit on the Permit Book process and concerns about potential improper disclosure of farmers' personal information, including Social Insurance Numbers (SINs), to third parties. The Office of the Privacy Commissioner of Canada (OPC) investigated and found that the CWB had appropriate protocols in place to safeguard personal information and that SINs were not disclosed to third parties. The OPC also found that personal data was only shared with the Canada Revenue Agency when required by law. Consequently, the complaint was dismissed as not well-founded.

• Whether the Canadian Wheat Board improperly disclosed personal information, including Social Insurance Numbers (SINs), of grain producers to third parties.
• Whether the Canadian Wheat Board complied with privacy legislation regarding the collection, use, safeguarding, and sharing of personal information.

An individual complained that the Canada Border Services Agency (CBSA) improperly collected personal information from his blog after his term position ended. The complainant posted information on the internet for public consumption. The investigation found that some CBSA employees had viewed the blog from government computers in a personal capacity, which was deemed to accord with the government's Acceptable Use Policy. The investigation found no evidence that the CBSA had collected personal information in connection with these visits.

• Whether the CBSA collected personal information from an individual's public blog.
• Whether employee access to the blog from government computers was in accordance with policy.

A public servant complained that Public Works and Government Services Canada (PWGSC) failed to provide her with access to her personal information, collected during an investigation under the Public Servants Disclosure Protection Act. Although the investigation completely exonerated her, she was not informed of this outcome. The Office found that while PWGSC correctly applied section 22.3 of the Privacy Act to refuse disclosure, it urged the department to inform subjects when allegations are unsubstantiated. The Commissioner also asked the Treasury Board Secretariat to develop mechanisms for departments to inform individuals of unsubstantiated allegations.

• Access to personal information collected during a whistleblower investigation
• Application of section 22.3 of the Privacy Act
• Obligation to inform individuals when allegations of wrongdoing are unsubstantiated

This investigation concerned the handling of personal information collected by the RCMP's Canadian Firearms Program and used by EKOS Research Associates Inc. to survey firearms licensees. The OPC found that the RCMP was authorized to collect the information for program administration and that its use for a client-satisfaction survey was consistent with the original purpose. The RCMP also complied with the Act in providing data to EKOS, as the contract included strong confidentiality provisions. As a result, the complaint was not well-founded.

• Lawful collection of personal information for program administration
• Use of personal information for client-satisfaction surveys
• Compliance with contractual confidentiality and security provisions
• Adequacy of privacy impact assessments

This investigation examined a complaint regarding the Royal Canadian Mounted Police's (RCMP) use and disclosure of personal information from the Canadian Firearms Program (CFP) database to a public opinion research firm, EKOS Research Associates Inc. The RCMP contracted EKOS to conduct a survey of firearms licensees to improve program administration and service delivery. The investigation reviewed the contract, security measures, and the survey process.

• Appropriateness of using personal information for a client-satisfaction survey.
• Compliance with contractual confidentiality and security provisions when disclosing information to a third-party contractor.
• Whether the use of information for the survey was consistent with the purpose for which it was originally collected.