Federal (Canada) privacy & access decisions

Multiple complainants alleged that Profile Technology Ltd. copied their personal information from Facebook profiles and groups without consent and posted it on its social networking website, making removal difficult, and indefinitely retaining helpdesk information. The OPC asserted jurisdiction over the New Zealand-based company due to a real and substantial connection to Canada. The OPC found that the information was not "publicly available" under PIPEDA's Regulations, and Profile Technology failed to obtain valid consent for its new purpose of operating a social networking site. Furthermore, the OPC determined that using this information for such a purpose was not appropriate in the circumstances and that the indefinite retention of helpdesk ticket information violated retention principles. Profile Technology refused to implement recommendations for deletion and a retention policy. Although the company later removed profiles from its website, it uploaded much of the data to the Internet Archive, which the OPC found did not resolve the contraventions and created new privacy risks. The matter was found to be well-founded.

• Whether the OPC had jurisdiction to investigate a New Zealand-based company's activities affecting Canadians.
• Whether the investigation was time-barred under subsection 13(1) of PIPEDA.
• Whether PIPEDA's application to commercial activity is constitutionally valid under the federal Trade and Commerce power.
• Whether personal information copied from Facebook profiles was "publicly available" under PIPEDA's Regulations Specifying Publicly Available Information.
• Whether Facebook profiles constitute a "publication" for the purposes of the Regulations.
• Whether Profile Technology obtained valid knowledge and consent (Principle 4.3 PIPEDA) for the collection, use, and disclosure of personal information for its social networking website.
• Whether consent obtained by Facebook was sufficient for Profile Technology's subsequent use of the data.
• Whether opt-out consent would be an appropriate form of consent in this context (Principle 4.3.4 PIPEDA).
• Whether Profile Technology's use of Facebook profile information for its social networking site was for purposes a reasonable person would consider "appropriate in the circumstances" (subsection 5(3) PIPEDA).
• Whether Profile Technology retained personal information (helpdesk tickets) longer than necessary (Principle 4.5 PIPEDA).
• Whether Profile Technology was responsible for personal information held by its third-party helpdesk service provider.
• Whether Profile Technology's actions of removing profiles from its website and uploading data to the Internet Archive resolved the identified contraventions.