Federal (Canada) privacy & access decisions

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers about its practice of sharing data with affiliates for marketing, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The company maintained that its privacy policy, code, and activation process provided a sufficient basis for customer knowledge and consent, and that it complied with CRTC restrictions on disclosing personal information. The investigation found that the company's privacy documents and activation process constituted a reasonable effort to advise individuals of secondary purposes and that customers could refuse or withdraw consent. The Assistant Commissioner concluded that the company was in compliance with PIPEDA.

• Whether the telecommunications company obtained adequate knowledge and consent for the collection, use, or disclosure of personal information for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection as per Principle 4.2.3
• Whether the company made a reasonable effort to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the form of consent sought by the organization was appropriate given the circumstances and type of information, considering Principle 4.3.4
• Whether the reasonable expectations of the individual were considered in obtaining consent, as per Principle 4.3.5

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The service allowed individuals to redirect mail and, with an opt-out clause in fine print, permitted Canada Post to supply new addresses to "mailers" for a fee. The Commissioner found that Canada Post failed to clearly inform customers that their personal information was being sold to organizations like list brokers and direct marketers, and that the consent obtained was not meaningful. Canada Post refused to implement a recommendation for an opt-in checkbox for this disclosure. The Commissioner concluded that Canada Post was in contravention of sections 5(2) and 8 of the Privacy Act for failing to plainly identify the purpose of collection and for disclosing personal information without proper consent.

• Whether Canada Post adequately informed individuals about the purpose of collecting their new address information for the NCOA service, specifically regarding disclosure to "mailers" for commercial purposes under s.5(2) of the Privacy Act
• Whether Canada Post obtained valid consent for the disclosure of new addresses to mass mailers and direct marketers under s.8 of the Privacy Act
• Whether the "opt-out" mechanism used by Canada Post constituted meaningful consent
• Whether the safeguard of only providing new addresses to mailers who already had the customer's name and old address adequately addressed consent concerns

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

The federal Privacy Commissioner investigated a complaint regarding Centurion Security Services' installation of surveillance cameras at a downtown Yellowknife intersection. The Commissioner found that both live and recorded video images of individuals constitute "personal information" under PIPEDA. Centurion Security Services, a private company, was monitoring public spaces for commercial purposes without the consent of individuals, which contravened Principle 4.3 of Schedule 1 and section 5(1) of the Act. Although the cameras were removed before the complaint was received, the Commissioner concluded that Centurion's intended future public video surveillance for commercial purposes would also be unlawful. The complaint was found to be well-founded.

• Whether the subject matter falls within the Commissioner's jurisdiction under PIPEDA
• Whether live video pictures of individuals constitute "personal information" under section 2 of PIPEDA
• Whether the collection of personal information was in the course of a commercial activity under section 4 of PIPEDA
• Whether Centurion Security Services collected personal information without consent in contravention of Principle 4.3 of Schedule 1 of PIPEDA
• Whether the absence of recording (live feed only) affects the classification of information as personal information or the requirement for consent

A complaint was made against a transportation company alleging that its sales agents were collecting passengers' date of birth and citizenship for Toronto-to-New York train bookings and disclosing this information to US Customs and US Naturalization and Immigration Service. The company confirmed this practice, stating it was an agreement with US authorities to minimize border delays. The OPC found that sales agents were representing the provision of this information as a requirement. The OPC advised the company to instruct its agents to present the provision of this information as voluntary and to seek consent after booking. The company issued a directive to its sales agents, and the OPC closed the file, subject to monitoring.

• Whether the transportation company was collecting personal information without proper consent
• Whether the transportation company was disclosing personal information without proper consent
• Whether sales agents were misrepresenting the voluntary nature of providing personal information

The complainant alleged that a federal institution failed to respond to an access request within the statutory 30-day period or an extended period, resulting in a deemed refusal under subsection 10(3) of the Access to Information Act. The complainant submitted their complaint on January 21, 2025, arguing that the deemed refusal was 'ongoing' and therefore the 60-day time limit for complaints under section 31 should not apply from the initial awareness date. The OIC requested clarification on when the complainant first became aware of the institution's failure to respond, but the complainant maintained their 'ongoing refusal' position. The OIC determined that the complaint was inadmissible because it was not submitted within the mandatory 60-day time limit from when the complainant first became aware of the grounds for complaint. The Commissioner rejected the argument that an 'ongoing' deemed refusal continuously restarts the complaint period, citing Federal Court precedent and emphasizing that the Act does not grant the Commissioner power to extend this time limit.

• Whether the complaint was submitted within the 60-day time limit prescribed by section 31 of the Access to Information Act
• Whether an 'ongoing' deemed refusal under subsection 10(3) of the Act continuously restarts the 60-day complaint period under section 31
• Whether the Information Commissioner has the power to extend the 60-day time limit for submitting complaints

The Information Commissioner ceased investigation into seventeen complaints, finding them vexatious. The complaints alleged unreasonable time extensions taken by an institution. However, the Commissioner found that these seventeen requests sought the same information as a previous request from the same complainant, which had already been the subject of an OIC investigation where the time extension was deemed reasonable. The complainant had not pursued a Federal Court review of the previous finding. Evidence showed the institution was providing regular interim responses as committed, contrary to the complainant's assertion. The Commissioner concluded that the new complaints were an attempt to circumvent the OIC's previous findings and avoid the proper recourse mechanism of Federal Court review. Therefore, the Commissioner ceased investigation under paragraphs 30(4)(a) and (b) of the Access to Information Act.

• Whether the complaints were vexatious under s.30(4)(a) ATIA
• Whether further investigation was unnecessary under s.30(4)(b) ATIA
• Whether the new requests were substantively duplicative of a previously investigated complaint
• Whether the complainant was attempting to circumvent previous OIC findings

The complainant submitted an access to information request to a federal institution and received a response in October 2021. The institution's response included a notice informing the complainant of their right to complain to the Information Commissioner within sixty days. The complainant filed a complaint with the Office of the Information Commissioner (OIC) in January 2022, which was more than sixty days after receiving the institution's response. The OIC determined that the complaint was submitted outside the mandatory 60-day timeframe specified in section 31 of the Access to Information Act. Citing legal precedents, the Commissioner concluded that the OIC does not have the authority to extend statutory timeframes. Consequently, the complaint was rejected.

• Whether the complaint was filed within the 60-day statutory timeframe as per s.31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The institution argued that it had already disclosed some of the requested information to the same requester through an informal request, and processing the formal request would be duplicative. The institution sought to limit the scope of the formal request by excluding the time period covered by the informal release. However, the Commissioner found that the institution did not adequately explain how the records would be duplicates, noting that the subject matter and type of records appeared different. The Commissioner also considered that the formal request might be seeking a present-day review of redactions applied to previously released records. Crucially, the institution failed to specify which criteria under subsection 6.1(1) (vexatious, bad faith, or abuse of right) it was relying on, nor did it provide sufficient evidence to support its claim of duplication meeting these criteria. Consequently, the Commissioner denied the application, requiring the institution to process the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the access request was an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution provided sufficient evidence to support its s.6.1 application
• Whether the institution's application was complete according to OIC guidance