Federal (Canada) Privacy Decisions

A complainant alleged that Canada Post collected excessive personal information when she applied for special paid leave to care for a relative. While Canada Post argued the extensive collection was necessary to prevent fraud and ensure fair administration of leave, the OPC found that too much personal data was requested, particularly about third parties. Canada Post accepted some recommendations, agreeing to collect only necessary information and update guidelines, but maintained its collection of data on other family members working at Canada Post to prevent abuse, a practice the OPC expressed reservations about.

• Necessity of collecting personal information for special leave applications
• Collection of personal information about third parties
• Balancing fraud prevention with privacy rights

A letter carrier complained that his supervisor had opened and read a sealed medical form submitted for a disability insurance claim. The investigation confirmed the supervisor used information from the form to challenge other medical documentation from the employee. The OPC found that the employee's personal information was used for an incompatible purpose without consent, upholding the complaint as well-founded.

• Unauthorized access to personal health information
• Use of personal information for an incompatible purpose
• Failure to ensure personal information was used only for the purpose for which it was collected

The Office of the Privacy Commissioner of Canada investigated a complaint concerning the Public Service Commission of Canada's collection and disclosure of an individual's medical release information from the Canadian Forces. The information was used for a priority hiring program for ex-military staff. The investigation found that the complainant had consented to the collection and disclosure.

• Collection and disclosure of personal information
• Consent to collection and disclosure
• Use of personal information for priority hiring program

Two prisoners complained after a report containing their personal information was found among a fellow inmate's belongings. An investigation determined that a contract worker printed the report, which was then accessible to a welding instructor. While the report was later discovered with another inmate's effects, it could not be determined how it got there. The Office of the Privacy Commissioner confirmed the privacy rights of the complainants had been breached.

• Unauthorized disclosure of personal information
• Safeguarding of personal information by staff and contractors
• Accountability for handling sensitive reports

A woman complained that her Social Insurance Number (SIN) and other personal information were mishandled at a mandatory employment insurance (EI) information session. The attendance sheet containing the SINs of 32 participants went missing. The Office of the Privacy Commissioner of Canada (OPC) investigated and found that HRSDC had not properly safeguarded the personal information, upholding the complaint as well-founded. HRSDC has since implemented new procedures to protect SINs at these sessions.

• Safeguarding of SINs and other personal information
• Adequacy of breach response and mitigation measures
• Preventing future breaches involving SINs

A veteran complained that Veterans Affairs Canada (VAC) had inappropriately used and shared his sensitive medical information in briefing notes to the Minister, and had transferred his medical file to a VAC-administered hospital without his consent. The investigation found that the briefing notes contained excessive medical details and that sensitive information was shared widely within VAC without a need-to-know. The transfer of the medical file also occurred without the required consent. The complaint was found to be well-founded.

• Inappropriate use and disclosure of sensitive medical information in briefing notes.
• Transfer of personal medical information to a hospital without consent.
• Failure to limit access to personal information on a need-to-know basis.
• Compliance with section 7 of the Privacy Act regarding use of personal information.

This investigation concerned a data spill involving 11,900 forms mailed to applicants for the Guaranteed Income Supplement. A mechanical malfunction caused some applicants to receive forms destined for other individuals, including names, addresses, and Social Insurance Numbers. Human error by the overseeing technician, who failed to use detection mechanisms and notify management, compounded the issue. The Office found the complaint well-founded and recommended that the department enhance employee awareness of their obligations to protect personal information.

• Adequacy of security safeguards for personal information
• Role of human error in compounding a mechanical defect
• Reporting obligations of employees regarding privacy breaches

An individual complained that the Canada Border Services Agency (CBSA) improperly collected personal information from his blog after his term position ended. The complainant posted information on the internet for public consumption. The investigation found that some CBSA employees had viewed the blog from government computers in a personal capacity, which was deemed to accord with the government's Acceptable Use Policy. The investigation found no evidence that the CBSA had collected personal information in connection with these visits.

• Whether the CBSA collected personal information from an individual's public blog.
• Whether employee access to the blog from government computers was in accordance with policy.

The Office of the Privacy Commissioner of Canada (OPC) received 82 complaints after Human Resources and Skills Development Canada (HRSDC) inadvertently disclosed the personal information of 191 Employment Insurance (EI) claimants. The disclosed information included names, dates of birth, employee identification numbers, and Social Insurance Numbers. HRSDC took immediate steps to retrieve the data, notify affected individuals, and implement preventative measures. The OPC found 79 of the 82 complaints to be well-founded.

• Inadvertent disclosure of personal information
• Adequacy of breach response measures
• Preventing recurrence of similar breaches

A public servant complained that Public Works and Government Services Canada (PWGSC) failed to provide her with access to her personal information, collected during an investigation under the Public Servants Disclosure Protection Act. Although the investigation completely exonerated her, she was not informed of this outcome. The Office found that while PWGSC correctly applied section 22.3 of the Privacy Act to refuse disclosure, it urged the department to inform subjects when allegations are unsubstantiated. The Commissioner also asked the Treasury Board Secretariat to develop mechanisms for departments to inform individuals of unsubstantiated allegations.

• Access to personal information collected during a whistleblower investigation
• Application of section 22.3 of the Privacy Act
• Obligation to inform individuals when allegations of wrongdoing are unsubstantiated

This investigation concerned the handling of personal information collected by the RCMP's Canadian Firearms Program and used by EKOS Research Associates Inc. to survey firearms licensees. The OPC found that the RCMP was authorized to collect the information for program administration and that its use for a client-satisfaction survey was consistent with the original purpose. The RCMP also complied with the Act in providing data to EKOS, as the contract included strong confidentiality provisions. As a result, the complaint was not well-founded.

• Lawful collection of personal information for program administration
• Use of personal information for client-satisfaction surveys
• Compliance with contractual confidentiality and security provisions
• Adequacy of privacy impact assessments

A Member of Parliament complained that an employee of the Toronto Port Authority used the organization's e-mail database to invite individuals to a political fundraising event. The investigation found that an employee sent an email using personal and business addresses obtained from business cards, soliciting donations. Although recipient addresses were in the BCC field, the employee's signature block indicated they worked for the Authority, implying institutional sanction.

• Use of institutional database for personal fundraising activities
• Collection and use of personal information for non-business purposes
• Impression of institutional sanction for personal activities

This investigation was initiated following media reports that a Canada Revenue Agency (CRA) employee posted personal tax information of athletes to an Internet chat group. The OPC found that a former employee did post information, and other CRA employees inappropriately accessed the athletes' tax information out of curiosity, which constituted a breach of the Privacy Act. The CRA took corrective measures, including disciplinary action against employees and modernization of its audit trail system.

• Unauthorized access to taxpayer information by CRA employees
• Disclosure of taxpayer information to an external party
• Adequacy of CRA's corrective measures and audit systems

This investigation examined a complaint regarding the Royal Canadian Mounted Police's (RCMP) use and disclosure of personal information from the Canadian Firearms Program (CFP) database to a public opinion research firm, EKOS Research Associates Inc. The RCMP contracted EKOS to conduct a survey of firearms licensees to improve program administration and service delivery. The investigation reviewed the contract, security measures, and the survey process.

• Appropriateness of using personal information for a client-satisfaction survey.
• Compliance with contractual confidentiality and security provisions when disclosing information to a third-party contractor.
• Whether the use of information for the survey was consistent with the purpose for which it was originally collected.

The Office of the Privacy Commissioner of Canada (OPC) investigated a Privacy Act complaint after media reported on the leak of a Canadian citizen's personal information from a Department of Foreign Affairs and International Trade (DFAIT) database. The investigation found that DFAIT lacked adequate controls, such as audit trails, to prevent or track unauthorized access and disclosure of the information. DFAIT agreed to implement better guidance and explore system changes to enhance security.

• Adequacy of security measures for personal information held in departmental computer systems.
• Lack of audit trail capability to track access to personal information.
• Responsibility of government institutions to protect personal information under the Privacy Act.