Federal (Canada) privacy & access decisions

The Office of the Privacy Commissioner (OPC) investigated incidents where CIBC misdirected faxes containing customer personal information to a US company and a business in Dorval, Quebec, over several years. Despite repeated notifications from the recipients, CIBC's attempts to resolve the issue were ineffective, and the bank failed to adequately recover the misdirected information or notify affected customers. The OPC found that CIBC's privacy practices failed at a basic organizational level, as employees did not fully recognize the misdirected faxes as privacy breaches and privacy officials were not informed. CIBC subsequently implemented remedial measures, including banning branch faxing, reviewing fax processes, and restructuring internal privacy management. The OPC recommended full implementation of planned changes, immediate notification of affected individuals in future breaches, and reporting back to the Assistant Privacy Commissioner. The OPC's Audit and Review Branch planned to verify the bank's actions.

• Whether CIBC's privacy practices adequately protected personal information from misdirected faxes
• Whether CIBC effectively responded to notifications of misdirected faxes
• Whether CIBC appropriately recovered misdirected personal information
• Whether CIBC adequately notified affected customers of privacy breaches
• Whether CIBC employees recognized misdirected faxes as privacy issues
• Whether CIBC's internal privacy management structure was sufficient to address breaches