Federal (Canada) privacy & access decisions

The complainant alleged that Biron Health Group (Biron) sent him promotional emails without his consent after he underwent mandatory COVID-19 testing upon arrival at Montreal Trudeau Airport. He provided his email solely for test results. Biron initially believed it had implicit consent due to an established business relationship. The OPC found that Biron could not reasonably assume implicit consent, as travellers had no choice but to use Biron for mandatory testing and would not expect their health information to be used for marketing. Biron ceased the practice and deleted affected email addresses from its marketing database. The complaint was settled during the investigation.

• Whether Biron Health Group had implicit consent to send promotional emails to individuals undergoing mandatory COVID-19 testing
• Whether the collection of personal information for mandatory health testing could be used for secondary marketing purposes

The parents of a 17-year-old dependent complained that they could not access their daughter's online dental benefit information from their group dental plan administrator. The administrator's policy required consent from individuals aged 16 or older before their information could be accessed by another plan member, even parents. The administrator defended its policy by citing PIPEDA's consent requirements, the lack of a national age of majority consensus, and the distinction between age of majority and age of consent. The policy was based on the Ontario Health Care Consent Act, which suggests 16 as an age for health care consent. The mother was satisfied with the explanation and understood that she could access her daughter's account if her daughter provided consent by sharing her password.

• Whether a dental plan administrator requires consent from a 17-year-old dependent to disclose her dental benefit information to her parents
• Whether the age of majority or age of consent impacts the requirement for consent under PIPEDA for minors

A client sought access to her personal information from her former lawyer. The lawyer refused access, citing outstanding fees and asserting a solicitor's lien on the client's file, believing that providing access could jeopardize payment. The OPC noted that PIPEDA's subsection 9(3) provides an exhaustive list of reasons for refusing access, which does not include a solicitor's lien. Therefore, lawyers must grant access to personal information even if a valid lien exists. The OPC suggested that allowing the individual to view, but not copy, the information could balance the right to access with the lien. The lawyer subsequently provided a complete copy of the file, and the complaint was settled.

• Whether a solicitor's lien is a valid ground to refuse access to personal information under PIPEDA
• Whether subsection 9(3) of PIPEDA provides an exhaustive list of circumstances for refusing access

An individual complained that a department store's method of collecting tax exemption information allowed other customers to view her personal data and the data of previous customers. The store used a petition-style form where customers wrote their names, shopping dates, and tax exemption numbers, making this information visible to subsequent customers. The complainant was concerned about the lack of privacy for her personal information. In response to the complaint, the department store first implemented a temporary measure of using a new form where only one customer's information appeared per page. Subsequently, the store reconfigured its cash registers to electronically print a receipt-style form for tax exemptions, which was then completed by the customer and securely stored in the register. This new electronic system prevented customers from viewing each other's personal information. The complainant was satisfied with these changes, and the matter was considered settled.

• Whether the department store's method of collecting tax exemption information allowed unauthorized disclosure of personal information to other customers
• Whether the department store adequately safeguarded customers' personal information

An individual complained that a DVD-rental store required him to provide his driver's license details for entry into their database to become a member, which he believed was unnecessary. The store initially argued this was a business necessity for identity verification and recovering overdue rentals. However, the investigation revealed the store did not use driver's license data for tracing members, but rather publicly available information. Recognizing it was collecting unnecessary information, the store revised its membership process. Under the new process, customers must present two pieces of identification, one with a photo, but driver's license details are no longer entered into the database. The store committed to updating its procedures and training staff on the new process.

• Whether collecting and recording driver's license details was necessary for the DVD-rental store's operations
• Whether the store's collection practices aligned with the principle of limiting collection to necessary information

A complainant alleged that a counselling firm, part of her employer's Employee Assistance Program (EAP), improperly disclosed sensitive personal information to her employer and others. The firm revealed she was using counselling services and believed she was a danger to herself, which the complainant disputed as a misinterpretation. The OPC's investigation found that a miscommunication occurred during a phone call between the complainant and her counsellor regarding the meaning of "having a plan." The counsellor, believing the complainant was suicidal, contacted emergency services, including the complainant's workplace. The police later concluded the complainant posed no danger. The counselling firm and the complainant reached a private settlement with the OPC's involvement. The firm subsequently revised its policies on disclosing personal information, emphasizing detailed case notes and limiting information shared with emergency services.

• Whether the counselling firm improperly disclosed personal information about the complainant to her employer and others
• Whether the information disclosed by the counselling firm was inaccurate
• Whether the counsellor misconstrued the complainant's statements during a telephone conversation
• Whether the counselling firm's disclosure of personal information was justified under circumstances of perceived imminent danger

An individual complained that a loyalty program shared his children's names and addresses with partner credit card companies, resulting in marketing materials being sent to the minors. The loyalty program stated it does not market to minors or share their information with partners. However, due to telephone account openings where birth dates were not mandatory, the children were not identified as minors in their profiles. This led to their information being shared for marketing purposes. The program acknowledged an overly long delay in correcting the issue, partly due to marketing lists being generated weeks in advance. The loyalty program sent an apology letter, and the mailings to the children ceased. The complaint was considered settled.

• Whether the loyalty program inappropriately disclosed personal information of minors to partner companies for marketing purposes
• Whether the loyalty program adequately protected the personal information of minor members
• Whether the loyalty program took appropriate and timely steps to resolve the complaint

An individual complained that a web-based company retained his personal information for too long after he cancelled his free trial membership. He also alleged that the company lacked accountability under PIPEDA, as it did not fully answer his privacy questions and had no designated privacy officer. The company explained that it retained personal information, including credit card details, to process rental requests, ship items, and prevent fraud, particularly to track individuals attempting to obtain multiple free trials. As a result of the complaint, the company revised its privacy policy to clarify retention purposes and periods for different types of information. It also trained its customer service staff and designated a privacy officer. The complainant was satisfied with these changes.

• Whether the web-based company retained personal information for too long after a free trial cancellation
• Whether the web-based company was fully accountable under PIPEDA
• Whether the web-based company adequately answered privacy-related questions
• Whether the web-based company had a designated person responsible for handling privacy issues

A tenant complained that the caretaker of his apartment building disclosed to other tenants that his rent cheque had bounced. The building management firm initially did not take the issue seriously, prompting the tenant to complain to the OPC. While the caretaker and his wife denied the disclosure, another tenant confirmed that the caretaker's wife had indeed shared this information, along with other tenants' rent details. The complainant sought a letter of apology from the building management firm. The firm provided the apology and also reminded the caretaker and his wife about their obligation not to discuss tenants' personal information. The OPC further advised the firm to create a privacy policy in compliance with PIPEDA. The matter was ultimately settled to the satisfaction of both the OPC and the complainant.

• Whether a building caretaker disclosed a tenant's personal information without consent
• Whether the building management firm adequately protected personal information
• Whether the building management firm had appropriate privacy policies in place

An individual complained that her dental clinic disclosed information about her overdue account to the person who had referred her to the clinic. The complainant had been in hospital and respite care, missing invoices. The clinic, seeking her whereabouts, disclosed to the referrer that her bill was overdue, the amount owing, and that it would go to collections. The clinic acknowledged this violated its privacy policy, stating it should have only requested contact information. During the investigation, the clinic and complainant reached a monetary settlement, including an apology letter. The OPC and complainant agreed the matter was settled.

• Whether the dental clinic disclosed personal information without consent
• Whether the disclosure of overdue bill details, amount owing, and collection threat to a third party was appropriate
• Whether the clinic's actions violated its own privacy policy

An individual complained after receiving promotional material and telemarketing calls following her application for a department store credit card, believing she had not consented to the use of her contact information for marketing. The department store asserted that her signature on the application form indicated agreement to its terms and conditions, which included marketing. The OPC found that the application form adequately explained how personal information would be used and provided an opt-out mechanism below the signature line. The OPC informed the complainant that this type of opt-out was permissible under PIPEDA. The complainant was satisfied with this explanation and requested removal from marketing lists, which the store completed. The complaint was settled during the investigation.

• Whether the department store obtained valid consent for using personal information for marketing purposes
• Whether the opt-out mechanism provided by the department store was compliant with PIPEDA

An individual complained that a condominium corporation disclosed personal information about her dispute with the corporation to all condominium owners. The corporation sent a letter detailing the alleged by-law contravention to all owners, posted it on a bulletin board, and included it in Board meeting minutes. The corporation initially believed only contact information, which it considered publicly available, was disclosed. However, the OPC clarified that the personal information at issue was the fact of the dispute itself. The corporation had disclosed this information without the complainant's consent. The matter was resolved when the condominium corporation sent the complainant a letter of apology.

• Whether the fact of an individual's dispute with a condominium corporation constitutes personal information under PIPEDA
• Whether the condominium corporation disclosed personal information without consent
• Whether the personal information was publicly available

An individual complained that a business withheld some of his personal information and its privacy policy. The business initially claimed the individual was not entitled to information predating January 1, 2004, when PIPEDA became applicable to it. After the complainant challenged this, the business provided the remaining personal information but still did not provide a privacy policy. The OPC discovered the business did not have a privacy policy. At the OPC's request, the business drafted a privacy policy and provided it to the complainant. The complainant considered the matter settled.

• Whether the business improperly withheld personal information requested by the individual
• Whether the business failed to make its privacy policy publicly available as required by PIPEDA

A student complained that a property management firm required his Social Insurance Number (SIN) to rent an apartment. The firm stated it needed the SIN for identity verification, credit checks, and collections. The OPC noted that while no legislation prevents organizations from asking for SINs for identification, organizations subject to PIPEDA must inform individuals that providing a SIN for identification is optional and not a condition of service. As a result of the complaint, the property manager revised the lease agreement to only require a driver's license for identification and stopped requesting SINs from potential renters. The student and the OPC considered the matter settled.

• Whether requiring a SIN for an apartment lease is permissible under PIPEDA
• Whether organizations must inform individuals that providing a SIN for identification is optional

An individual complained that a restaurant's credit card receipts displayed her name, full credit card number, and expiry date, arguing this information should be masked. The restaurant used electronic processing equipment that did not mask this information. The OPC found that the personal information was collected, used, and stored in a manner consistent with PIPEDA principles, and there was no unauthorized disclosure. However, the OPC noted that technology for masking credit card information on receipts exists and that industry representatives indicated all equipment would mask this information by 2007. The complainant was satisfied with this information and the restaurant owner's awareness of privacy legislation. The matter was settled during the investigation.

• Whether the display of full credit card details on receipts constituted a contravention of PIPEDA
• Whether the collection, use, and storage of personal information on credit card receipts was consistent with PIPEDA principles
• Whether there was unauthorized disclosure of personal information