Federal (Canada) privacy & access decisions

An individual complained that an RCMP staff sergeant inappropriately disclosed personal information about him at a community meeting. The sergeant, invited to discuss a decade-old murder case, named the complainant as a "person of interest" and stated he had declined a polygraph test. The complainant alleged he was not fully informed about the subject matter of the discussion. The RCMP presumed consent based on the complainant's attendance and assurances from community group representatives. The OPC found that the RCMP had a responsibility to actively obtain consent for the disclosure, rather than presuming it. The complaint was upheld as well-founded.

• Whether the RCMP inappropriately disclosed personal information about the complainant at a community meeting
• Whether the RCMP obtained valid consent for the disclosure of personal information

Two prisoners at the Correctional Service of Canada’s Grande Cache Institution filed complaints after a prison report containing their personal information was found among a fellow inmate's personal effects. An investigation revealed that a contract worker had printed the report, which listed personal information of all inmates, and given it to a welding instructor. The report was later discovered in an offender's belongings, though it was unclear how it got there. Correctional Service officials acknowledged the privacy breach and implemented several corrective measures, including restricting the printing of such reports and reinforcing training on safeguarding personal information. The OPC's investigation confirmed a breach of the complainants' privacy rights. Due to the corrective actions already taken, the OPC did not require further action.

• Whether the personal information of inmates was inappropriately disclosed
• Whether the Correctional Service of Canada adequately safeguarded personal information

An individual complained that Canada Post collected excessive personal information for special paid leave requests to care for an ailing relative. The application form, intended for supervisors, was mistakenly given to the complainant to complete, requiring extensive personal information about herself, the ill person, and third parties. Canada Post argued that arbitration rulings and fraud prevention concerns necessitated the collection of substantial information. The OPC found that more personal information was collected than necessary to establish leave entitlement, particularly regarding third parties. The complaint was upheld as well-founded, and the OPC recommended measures to address privacy concerns. Canada Post agreed to some changes, but insisted on collecting information about other family members working at Canada Post, which the OPC still had reservations about.

• Whether Canada Post collected excessive personal information for special paid leave requests
• Whether the information collected about third parties was necessary
• Whether the collection of information about other family members working at Canada Post was justified for fraud prevention

A woman complained to the OPC after an attendance sheet containing her Social Insurance Number (SIN), name, and telephone number, along with those of 31 other employment insurance (EI) claimants, went missing from an HRSDC information session. HRSDC officials notified affected individuals, apologized, and provided information on identity theft protection. The OPC investigated and found that HRSDC had failed to properly safeguard the personal information. The OPC was particularly concerned that the breach involved SINs, which are highly vulnerable to misuse. HRSDC subsequently directed officials to black out SINs on attendance sheets for future sessions.

• Whether Human Resources and Skills Development Canada (HRSDC) properly safeguarded personal information, specifically Social Insurance Numbers (SINs), names, and telephone numbers, on an attendance sheet at an employment insurance information session.

A Canada Post letter carrier complained that his supervisor accessed and used his medical information without authorization. The complainant alleged he gave a sealed medical form for a disability insurance claim to his supervisor to forward to the insurer, but the supervisor opened and read it. The supervisor admitted she might have read the form but denied opening a sealed envelope. The investigation could not confirm if the envelope was sealed, but it did confirm the supervisor used the health information to challenge other medical documentation provided by the employee. The OPC concluded that the personal information was used for an inconsistent purpose without permission, finding the complaint well-founded. The OPC recommended Canada Post remind staff to submit forms directly to the insurer and managers to refuse to accept such forms.

• Whether the supervisor gained unauthorized access to the medical form
• Whether the personal information was used for a purpose inconsistent with its collection
• Whether the use of information was without the complainant's permission

An inmate at Kent Institution complained after a 10-page National Parole Board decision containing graphic details of his offence was intercepted and circulated among other inmates. The document was supposed to be delivered via internal mail but was only folded and stapled, not placed in an envelope. Prison officials acknowledged the breach and launched an investigation, which confirmed the document was viewed by various inmates. The OPC's investigation found that the disclosure violated the Privacy Act. As a result, the warden implemented changes to ensure confidential documents are now placed in sealed envelopes.

• Whether the disclosure of the inmate's National Parole Board decision to other inmates violated the Privacy Act

A former inmate at Toronto's Keele Community Correctional Centre complained after a psychiatric nurse employed by the facility left an envelope containing his treatment notes on public transit. The director of the centre acknowledged the privacy breach, apologized, and stated that internal actions were taken to prevent recurrence. The nurse was reminded of his duty to safeguard personal information and not to transport patient files from the office unless encrypted. The OPC's investigation confirmed the privacy breach and found the complaint to be well-founded. However, the OPC also concluded that the facility had taken appropriate corrective measures following the incident.

• Whether the psychiatric nurse's actions constituted a privacy breach
• Whether the institution took appropriate corrective measures after the breach

An individual complained after Health Canada refused to provide him with personal information collected during a fitness-for-work evaluation. Health Canada cited section 28 of the Privacy Act, arguing that disclosing information related to his physical or mental health would be contrary to his best interests. The OPC's investigation found that the requested information was not limited to sensitive health records. Therefore, section 28 did not provide a valid reason to withhold access. The complaint was upheld as well-founded, and Health Canada subsequently agreed to release the information, leading to a resolved outcome.

• Whether Health Canada erred in withholding personal information
• Whether section 28 of the Privacy Act applied to the requested information
• Whether the information was confined to sensitive records related to mental or physical health

A veteran complained that Veterans Affairs Canada (VAC) inappropriately used his personal information by including excessive medical details in briefing notes for the Minister and by transferring his medical file to a hospital without consent. The OPC investigation found that briefing notes contained sensitive medical information far beyond what was necessary for their stated purpose and that this information was widely shared within VAC on a non-need-to-know basis. It also found that VAC transferred the complainant's medical file to a hospital it administered without obtaining his consent, despite departmental guidelines requiring it. The OPC concluded that VAC's actions violated section 7 of the Privacy Act, which governs the use of personal information. The complaint was found to be well-founded, and the OPC issued several recommendations to VAC, including developing an enhanced privacy policy framework, revising information-management practices, providing employee training, and reviewing consent procedures for information transfers.

• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by including excessive medical details in briefing notes for the Minister.
• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by widely sharing sensitive personal information within the department on a non-need-to-know basis.
• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by transferring his medical file to a hospital without obtaining his consent.

The Office of the Privacy Commissioner of Canada (OPC) received 82 complaints after Human Resources and Skills Development Canada (HRSDC) inadvertently disclosed the personal information of 191 Employment Insurance (EI) claimants to another individual. The disclosure occurred when an individual appealing an EI claim denial received an appeal docket that included names, dates of birth, employee identification numbers, and Social Insurance Numbers of 191 fellow employees, along with a second list of employment and leave statuses. The OPC's investigation confirmed that in 79 instances, the information was indeed released, leading to well-founded findings. HRSDC took immediate steps to retrieve the data, notify affected parties, and advise on identity theft prevention. They also implemented measures to prevent future recurrences, including reminding officials of proper procedures for protecting personal information during appeals.

• Whether Human Resources and Skills Development Canada inadvertently disclosed personal information of EI claimants
• Whether the disclosure of names, dates of birth, employee identification numbers, and Social Insurance Numbers constituted a contravention of the Privacy Act
• Whether the disclosure of employment and leave status constituted a contravention of the Privacy Act

In March 2009, Human Resources and Skills Development Canada (HRSDC) mailed 11,900 forms for the Guaranteed Income Supplement. Due to a mechanical malfunction and human error, some individuals received forms intended for others, containing names, addresses, and Social Insurance Numbers (SINs). The OPC initiated a complaint after HRSDC notified them of 44 reported cases of mix-ups. The investigation found that a technician failed to stop the mailing despite noticing errors and did not report the issue to management. The OPC determined the complaint was well-founded, highlighting both mechanical failure and human error. HRSDC conducted its own investigation, improved equipment, and strengthened quality control procedures. The OPC recommended better employee sensitization to privacy obligations, which HRSDC committed to implementing.

• Whether personal information was inappropriately disclosed due to mechanical malfunction
• Whether personal information was inappropriately disclosed due to human error
• Whether the institution adequately safeguarded personal information during mass mailings
• Whether employees were sufficiently sensitized to their obligations to safeguard personal information

The Commissioner initiated an investigation following media allegations that a Canada Revenue Agency (CRA) employee posted personal tax information of high-profile sports figures to an Internet chat group. The investigation confirmed that a former CRA employee had posted such information, and that other CRA employees had inappropriately accessed the tax information of these athletes, likely out of curiosity. While there was no evidence that these employees disclosed the information to outside sources, accessing personal tax information without authorization and for purposes unrelated to duties constitutes a breach of the Privacy Act. Consequently, the portion of the complaint concerning the improper use of personal information by CRA employees was found to be well-founded. The CRA took corrective measures, including suspending one employee, firing two others, and modernizing its audit trail system to monitor access to taxpayer information.

• Whether CRA employees inappropriately accessed personal tax information
• Whether CRA employees disclosed personal tax information to outside sources
• Whether accessing personal tax information without authorization and for purposes unrelated to duties constitutes a breach of the Privacy Act

A Member of Parliament complained that an employee of the Toronto Port Authority (TPA) misused the organization's email database to invite people to a political fundraising event. The investigation found that a TPA employee sent an email to approximately 60 people, soliciting donations and inviting participation in a fundraiser for another MP. The employee obtained these email addresses from business cards collected by the TPA, including both business and personal addresses. The OPC determined that the employee used this personal information without the TPA's knowledge or authorization and for reasons unrelated to the organization's business activities. The complaint was found to be well-founded, but the TPA took corrective measures, including reminding employees of their responsibilities and pledging Privacy Act training.

• Whether a Toronto Port Authority employee misused personal information for a political fundraiser
• Whether email addresses obtained from business cards constitute personal information
• Whether the use of personal information was without the knowledge or authorization of the institution
• Whether the use of personal information was for reasons unrelated to the organization's business activities

The OPC investigated a complaint regarding the leak of a Canadian citizen's personal information from a DFAIT database, which was reported in the media in spring 2008. The investigation confirmed the information was held in an official consular record within DFAIT's computer system. A significant concern was that 1,231 DFAIT employees had access to these files, and the system lacked audit trail capabilities or mechanisms to restrict access to specific records. Consequently, the OPC could not identify the source of the leak. The complaint was found to be well-founded, and DFAIT agreed to implement corrective measures.

• Whether personal information was leaked from a DFAIT database
• Whether DFAIT's security safeguards were adequate to protect personal information
• Whether DFAIT's computer system had sufficient audit trail capabilities
• Whether DFAIT's computer system had mechanisms to restrict access to particular files

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The service allowed individuals to redirect mail and, with an opt-out clause in fine print, permitted Canada Post to supply new addresses to "mailers" for a fee. The Commissioner found that Canada Post failed to clearly inform customers that their personal information was being sold to organizations like list brokers and direct marketers, and that the consent obtained was not meaningful. Canada Post refused to implement a recommendation for an opt-in checkbox for this disclosure. The Commissioner concluded that Canada Post was in contravention of sections 5(2) and 8 of the Privacy Act for failing to plainly identify the purpose of collection and for disclosing personal information without proper consent.

• Whether Canada Post adequately informed individuals about the purpose of collecting their new address information for the NCOA service, specifically regarding disclosure to "mailers" for commercial purposes under s.5(2) of the Privacy Act
• Whether Canada Post obtained valid consent for the disclosure of new addresses to mass mailers and direct marketers under s.8 of the Privacy Act
• Whether the "opt-out" mechanism used by Canada Post constituted meaningful consent
• Whether the safeguard of only providing new addresses to mailers who already had the customer's name and old address adequately addressed consent concerns