Federal (Canada) Privacy Decisions

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless Internet connection to post messages to a website during an investigation. The Office found no evidence that the CHRC accessed the complainant's connection or collected any of her personal information. Technological experts suggested the association of the complainant's IP address to the CHRC was likely a mismatch by a third party.

• Whether the CHRC improperly collected and used the complainant's personal information by accessing her Internet connection.
• Whether an IP address constitutes personal information.
• Evidence of unauthorized access to personal information.

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information, alleging the CHRC accessed her wireless internet connection to post messages on a website. The investigation examined whether the CHRC contravened sections 4 to 8 of the Privacy Act. Ultimately, the OPC found no evidence that the CHRC collected or used the complainant's personal information, concluding the complaint was not well-founded.

• Whether the IP address constitutes personal information under the Privacy Act.
• Whether the CHRC collected and used the complainant's personal information during its investigations.
• Whether the CHRC improperly disclosed or retained the complainant's personal information.

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The complainant argued that Canada Post failed to adequately inform subscribers that their new addresses would be disclosed to third-party "mailers" (including mass marketers and direct marketers) for commercial purposes. The Commissioner found that Canada Post contravened sections 5(2) and 8 of the Privacy Act by not clearly identifying this purpose of disclosure and by failing to obtain the necessary consent from individuals.

• Adequacy of information provided to NCOA service subscribers regarding disclosure of new addresses to third parties.
• Whether consent obtained for NCOA service implicitly includes consent for disclosure to mass marketers and direct marketers.
• Canada Post's use of "negative consent" (opt-out) versus "positive consent" (opt-in) for disclosure of personal information.