Federal (Canada) privacy & access decisions

An individual complained that Canada Post collected excessive personal information for special paid leave requests to care for an ailing relative. The application form, intended for supervisors, was mistakenly given to the complainant to complete, requiring extensive personal information about herself, the ill person, and third parties. Canada Post argued that arbitration rulings and fraud prevention concerns necessitated the collection of substantial information. The OPC found that more personal information was collected than necessary to establish leave entitlement, particularly regarding third parties. The complaint was upheld as well-founded, and the OPC recommended measures to address privacy concerns. Canada Post agreed to some changes, but insisted on collecting information about other family members working at Canada Post, which the OPC still had reservations about.

• Whether Canada Post collected excessive personal information for special paid leave requests
• Whether the information collected about third parties was necessary
• Whether the collection of information about other family members working at Canada Post was justified for fraud prevention

Two prisoners at the Correctional Service of Canada’s Grande Cache Institution filed complaints after a prison report containing their personal information was found among a fellow inmate's personal effects. An investigation revealed that a contract worker had printed the report, which listed personal information of all inmates, and given it to a welding instructor. The report was later discovered in an offender's belongings, though it was unclear how it got there. Correctional Service officials acknowledged the privacy breach and implemented several corrective measures, including restricting the printing of such reports and reinforcing training on safeguarding personal information. The OPC's investigation confirmed a breach of the complainants' privacy rights. Due to the corrective actions already taken, the OPC did not require further action.

• Whether the personal information of inmates was inappropriately disclosed
• Whether the Correctional Service of Canada adequately safeguarded personal information

An individual complained after Health Canada refused to provide him with personal information collected during a fitness-for-work evaluation. Health Canada cited section 28 of the Privacy Act, arguing that disclosing information related to his physical or mental health would be contrary to his best interests. The OPC's investigation found that the requested information was not limited to sensitive health records. Therefore, section 28 did not provide a valid reason to withhold access. The complaint was upheld as well-founded, and Health Canada subsequently agreed to release the information, leading to a resolved outcome.

• Whether Health Canada erred in withholding personal information
• Whether section 28 of the Privacy Act applied to the requested information
• Whether the information was confined to sensitive records related to mental or physical health

A woman complained to the OPC after an attendance sheet containing her Social Insurance Number (SIN), name, and telephone number, along with those of 31 other employment insurance (EI) claimants, went missing from an HRSDC information session. HRSDC officials notified affected individuals, apologized, and provided information on identity theft protection. The OPC investigated and found that HRSDC had failed to properly safeguard the personal information. The OPC was particularly concerned that the breach involved SINs, which are highly vulnerable to misuse. HRSDC subsequently directed officials to black out SINs on attendance sheets for future sessions.

• Whether Human Resources and Skills Development Canada (HRSDC) properly safeguarded personal information, specifically Social Insurance Numbers (SINs), names, and telephone numbers, on an attendance sheet at an employment insurance information session.

A former inmate at Toronto's Keele Community Correctional Centre complained after a psychiatric nurse employed by the facility left an envelope containing his treatment notes on public transit. The director of the centre acknowledged the privacy breach, apologized, and stated that internal actions were taken to prevent recurrence. The nurse was reminded of his duty to safeguard personal information and not to transport patient files from the office unless encrypted. The OPC's investigation confirmed the privacy breach and found the complaint to be well-founded. However, the OPC also concluded that the facility had taken appropriate corrective measures following the incident.

• Whether the psychiatric nurse's actions constituted a privacy breach
• Whether the institution took appropriate corrective measures after the breach

An inmate at Kent Institution complained after a 10-page National Parole Board decision containing graphic details of his offence was intercepted and circulated among other inmates. The document was supposed to be delivered via internal mail but was only folded and stapled, not placed in an envelope. Prison officials acknowledged the breach and launched an investigation, which confirmed the document was viewed by various inmates. The OPC's investigation found that the disclosure violated the Privacy Act. As a result, the warden implemented changes to ensure confidential documents are now placed in sealed envelopes.

• Whether the disclosure of the inmate's National Parole Board decision to other inmates violated the Privacy Act

A Canada Post letter carrier complained that his supervisor accessed and used his medical information without authorization. The complainant alleged he gave a sealed medical form for a disability insurance claim to his supervisor to forward to the insurer, but the supervisor opened and read it. The supervisor admitted she might have read the form but denied opening a sealed envelope. The investigation could not confirm if the envelope was sealed, but it did confirm the supervisor used the health information to challenge other medical documentation provided by the employee. The OPC concluded that the personal information was used for an inconsistent purpose without permission, finding the complaint well-founded. The OPC recommended Canada Post remind staff to submit forms directly to the insurer and managers to refuse to accept such forms.

• Whether the supervisor gained unauthorized access to the medical form
• Whether the personal information was used for a purpose inconsistent with its collection
• Whether the use of information was without the complainant's permission

A complainant alleged that a public opinion research firm unnecessarily collected her full date of birth and failed to adequately inform her about the purpose of a profiling survey. The firm collected full birth dates for demographic purposes and to verify identity, arguing that month and year alone were insufficient. The OPC found that collecting the full date of birth was not necessary for the firm's stated purposes and that the consent language for profiling surveys was not sufficiently clear. While the firm agreed to clarify its consent language, it refused to stop collecting or delete the day of birth from its records. Consequently, the OPC found the complaint well-founded but partially unresolved regarding the collection of full birth dates.

• Whether it is necessary for the Respondent to collect all three elements of the date of birth at registration
• Whether it is necessary for the Respondent to confirm all three elements of the date of birth in profiling surveys
• Whether the Respondent adequately informed the complainant of the purpose of the profiling survey
• Whether consent under Principle 4.3 was meaningful
• Whether the collection of personal information was limited to that which is necessary for the identified purposes under Principle 4.4