Federal (Canada) privacy & access decisions

This incident summary details two separate investigations into misdirected faxes containing personal health information. In both cases, faxes from Dynacare and Viewpoint were erroneously sent to apartment managers. The OPC found that both companies disclosed personal information without consent, contravening PIPEDA. Dynacare implemented an electronic auto-fax function and revised policies, while Viewpoint committed to retrieving misdirected faxes and verifying numbers. The Assistant Commissioner recommended both organizations implement OPC faxing guidelines, notify affected individuals, and annually update employee confidentiality agreements.

• Whether Dynacare disclosed personal information without consent, contrary to PIPEDA
• Whether Viewpoint disclosed personal information without consent, contrary to PIPEDA
• Whether Dynacare's security safeguards were adequate to prevent misdirected faxes
• Whether Viewpoint's security safeguards were adequate to prevent misdirected faxes
• Whether Dynacare should notify the affected individual
• Whether Viewpoint should notify the affected individual