Federal (Canada) Privacy Decisions

An individual complained that a telecommunications company failed to obtain proper consent for using and sharing customer data with affiliates for secondary marketing purposes. The company made its privacy policy available online and in distributed documents, but did not actively draw customers' attention to it during the sign-up process, making the information difficult to find. The Assistant Privacy Commissioner found that the company did not make reasonable efforts to inform customers about how their data would be used, leading to a contravention of PIPEDA principles regarding knowledge and consent for secondary uses of personal information.

• Adequacy of consent for secondary marketing purposes
• Company's efforts to inform customers of privacy practices
• Accessibility and clarity of privacy policy information
• Reasonable expectations of customers regarding data use

An individual complained that a bank failed to obtain adequate consent for using and sharing customer data with affiliates for secondary marketing purposes, arguing the bank did not clearly inform customers or provide an easy opt-out mechanism. The Office of the Privacy Commissioner of Canada (OPC) investigated and found the bank's practices and materials, including informing customers of privacy policies and providing an opt-out process, constituted a reasonable effort to ensure customer knowledge and consent. The OPC concluded the bank was in compliance with PIPEDA principles regarding secondary marketing.

• Adequacy of consent for secondary marketing purposes
• Clarity of information provided to customers about data use and sharing
• Availability and ease of the opt-out process
• Bank's compliance with PIPEDA principles on knowledge and consent

The Office of the Privacy Commissioner investigated a website that was broadcasting live audio from cellular telephones onto the internet. The investigation was discontinued after the Internet Service Provider shut down the Ottawa-based website due to bandwidth issues. The website had moved to a server in New York under new management.

• Unauthorized interception and broadcasting of private cell phone conversations
• Privacy implications of using scanners to capture cellular traffic
• Responsibility of Internet Service Providers for content hosted on their networks

The federal Privacy Commissioner investigated a complaint regarding a security company's installation of street surveillance cameras. The Commissioner found that live video feeds of individuals constituted personal information under PIPEDA and that collecting this information for commercial purposes without consent was unlawful. The company was informed that its intended public video surveillance for commercial purposes is not compliant with privacy laws.

• Definition of personal information under PIPEDA (specifically regarding live video feeds)
• Application of PIPEDA to commercial activities
• Consent requirements for collecting personal information
• Lawfulness of private sector surveillance in public spaces

The OPC investigated a complaint concerning a transportation company's practice of collecting passengers' dates of birth and citizenship for the Toronto-to-New York route and disclosing this information to U.S. Customs. The company confirmed this practice, which began in 2000, was an agreement with U.S. border agencies to minimize delays. The OPC determined that sales agents misrepresented the collection of this information as mandatory.

• Collection of personal information without adequate notice or consent
• Disclosure of personal information to a third party (U.S. Customs)
• Misrepresentation of information collection as mandatory