Federal (Canada) privacy & access decisions

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without consent. The OPC's investigation found merit in the complaint. The lending institution agreed to apologize to the complainant and adjust her outstanding loan. Furthermore, the OPC noted the institution lacked privacy policies and practices. The institution committed to implementing privacy policies, establishing a privacy committee, providing employee training, and reminding staff about limiting information disclosure during debt recovery. Both the complainant and the OPC were satisfied with these actions.

• Whether the lending institution disclosed personal information without consent
• Whether the lending institution had adequate privacy policies and practices in place

An employee of a national transportation company complained about the security of personal information in an automated crew management system. The complainant was concerned that unauthorized personnel, particularly union representatives, could access sensitive data like date of birth, social insurance number, wage rates, and vacation eligibility. While some information was not accessible to union representatives, the company agreed to modify the system. The adjustments ensured that screens would no longer display Social Insurance Numbers, birth dates, and health information. As the complainant's concerns were addressed, the case was considered settled.

• Whether employee personal information in an automated crew management system was adequately protected from unauthorized access
• Whether union representatives had unauthorized access to sensitive employee personal information