Federal (Canada) privacy & access decisions

A complainant objected to the Law School Admission Council's (LSAC) requirement for Canadian students to provide fingerprints to write the Law School Admission Test (LSAT). LSAC, a US-based non-profit, argued it was outside PIPEDA's jurisdiction and its activities were educational. The Assistant Privacy Commissioner found sufficient links to Canada for PIPEDA to apply and determined LSAC's activities were administrative, not educational. Applying a four-part test, the Assistant Commissioner found fingerprinting was not demonstrably necessary, effective, or proportional, and less privacy-invasive alternatives existed. LSAC agreed to cease fingerprint collection but reserved the right to reinstate it, proposing photographic evidence instead. The Assistant Commissioner found the complaint well-founded due to the disproportionate nature of fingerprint collection and LSAC's reservation to reinstate the policy.

• Whether LSAC's activities fall within the scope of PIPEDA despite its non-profit status and US location
• Whether LSAC's activities are educational in nature or serve administrative needs
• Whether the collection of thumbprints is demonstrably necessary to meet a specific need
• Whether the collection of thumbprints is likely to be effective in meeting that need
• Whether the loss of privacy from thumbprint collection is proportional to the benefit gained
• Whether there is a less privacy-invasive way of achieving the same end as thumbprint collection
• Whether the collection of photographs as an alternative is acceptable under PIPEDA
• Whether LSAC's reservation of the right to reinstate its fingerprint policy is compliant with PIPEDA

The OPC investigated Ticketmaster Canada Limited (TM) following a complaint that its practices for collecting, disclosing, and using customer personal information for marketing purposes did not comply with PIPEDA. The complainant alleged that customers were not properly informed or given a viable alternative to sharing their information for marketing. The Assistant Privacy Commissioner found that TM failed to uphold the principles of openness and consent. TM subsequently revised its privacy policy and online notifications to explicitly communicate information sharing practices and provide clear opt-in options for marketing. The investigation concluded that the issues were resolved satisfactorily, but the Assistant Commissioner expressed concern about the well-founded violations several years after PIPEDA's enactment.

• Whether Ticketmaster's privacy policy met the openness principle of PIPEDA
• Whether Ticketmaster obtained valid consent for the use of personal information for marketing purposes
• Whether customers were properly informed about the use of their personal information for marketing
• Whether customers were provided a viable opt-in/opt-out option for marketing without penalty
• Whether Ticketmaster's agreements with event providers ensured compliance with customer preferences