Federal (Canada) privacy & access decisions

The OPC initiated an investigation into Peoples Trust following a data breach that compromised sensitive personal information of approximately 12,000 customers. The investigation found that Peoples Trust failed to implement adequate technological and organizational safeguards, including using an outdated and vulnerable web editor and lacking ongoing monitoring. Additionally, the organization unnecessarily stored duplicate, unencrypted customer information on a web server for longer than required, contravening its retention policies. Following the OPC's intervention, Peoples Trust implemented comprehensive remedial measures, such as redesigning its web portal, enhancing monitoring, and developing a new Information Security Policy. As a result, the OPC concluded the matter was well-founded and resolved.

• Whether Peoples Trust implemented adequate technological and organizational safeguards appropriate to the sensitivity of the information, as per Principle 4.7 and 4.1.4(a) PIPEDA
• Whether Peoples Trust retained personal information for longer than necessary to fulfill its purposes, as per Principle 4.5 PIPEDA

An individual complained after receiving a promotional phone call from a hotel chain shortly after visiting its website, suspecting the hotel linked her IP address to her phone number. The hotel chain denied making such calls or collecting her personal information, stating the call was part of a telemarketing scam by an unrelated party. The OPC's investigation confirmed the calls were indeed a scam. The complainant suggested the hotel warn its customers, which the hotel did. The matter was resolved through the OPC's early resolution process.

• Whether the hotel chain collected the complainant's personal information (phone number) from her website visit
• Whether the promotional phone call originated from the hotel chain or an unrelated third party

The Office of the Privacy Commissioner (OPC) initiated a complaint against Health Canada (HC) after HC sent 41,514 letters to "Marihuana Medical Access Program" (MMAP) clients in windowed envelopes that allowed the program name to be openly visible. The OPC also received 339 individual complaints regarding this incident. Complainants were concerned that the visible program name revealed their association with MMAP to Canada Post employees and the public, potentially impacting their careers, reputation, and safety due to the stigma associated with marihuana. HC argued that the disclosure was implicitly consented to, was a consistent use of information, or was not an unlawful disclosure by HC. The OPC found that the combination of the MMAP name and the individual's name and address constituted sensitive personal information. HC failed to demonstrate appropriate consent or that any permissible disclosures under section 8(2) of the Privacy Act applied. The OPC concluded that HC contravened the Privacy Act.

• Whether the phrase "Marihuana Medical Access Program" combined with an individual's name and address constitutes personal information under section 3 of the Privacy Act
• Whether subsequent actions by individuals (e.g., media communication) alter Health Canada's obligations under the Privacy Act
• Whether mail recipients implicitly consented to the disclosure of their personal information under section 8(1) of the Privacy Act
• Whether the disclosure was a "consistent use" under section 8(2)(a) of the Privacy Act
• Whether limiting information on return address blocks would have broad implications for government communication

A former Canadian Forces member complained that the Department of National Defence (DND) prematurely destroyed an audio recording of his Progress Review Board (PRB) hearing, thereby contravening the retention and disposal provisions of the Privacy Act. The complainant argued that the recording was personal information used for an administrative purpose and should have been retained for a reasonable period to allow him access. DND contended the recording was a "transitory" record, destroyed after minutes were drafted, and that the complainant had implicitly consented to its disposal by signing the minutes. The OPC found that the audio recording contained personal information used for an administrative purpose and that the complainant had not consented to its disposal. Therefore, DND was obligated to retain the recording for at least two years.

• Whether the audio recording contained the complainant's "personal information" as defined by the Act
• Whether the personal information in the audio recording was used for an "administrative purpose"
• Whether the complainant consented to the disposal of the information
• Whether DND's classification of the recording as "transitory" exempted it from Privacy Act retention requirements

An office building tenant complained about five video surveillance cameras installed in a shared common area by another tenant, a call centre company. The complainant found it disturbing that the cameras recorded his and his clients' movements, particularly two cameras positioned between his office, the washrooms, and the elevators. The installing tenant claimed the cameras were for safety following a security incident and that building management had authorized their installation. After the OPC became involved, the building management facilitated the relocation of the two most concerning cameras from the shared hallway into the installing tenant's offices. The complainant expressed satisfaction that his and his clients' privacy rights were now respected. The case was resolved early.

• Whether the installation of video surveillance cameras in a shared common area by one tenant infringed on the privacy of another tenant and their clients
• Whether the collection of personal information via video surveillance was appropriate and proportionate to the stated safety purpose
• Whether consent was obtained for the video surveillance

This report addresses complaints against the Canadian Broadcasting Corporation (CBC) regarding its publication of personal information inadvertently disclosed by the Canada Revenue Agency (CRA). The CRA mistakenly mailed a spreadsheet containing taxpayers' personal information to a CBC journalist. The CBC subsequently published an article detailing the breach, identifying several affected individuals, and including their photographs. Complainants alleged the CBC contravened the Privacy Act by disclosing this information. The CBC argued that the information was obtained legally and that the Privacy Act does not apply to information collected, used, or disclosed for journalistic purposes under section 69.1 of the Act. The OPC found that the CBC's actions were purely journalistic and therefore fell under this exclusion, meaning the Privacy Act did not apply to the CBC's handling of the information.

• Whether the information published by the CBC constituted personal information under section 3 of the Privacy Act
• Whether the CBC's collection, use, and disclosure of the personal information was for journalistic purposes
• Whether the exclusion provision under section 69.1 of the Privacy Act applied to the CBC's actions

The Canada Revenue Agency (CRA) inadvertently mailed the personal information of approximately 1,000 individuals to a Canadian Broadcasting Corporation (CBC) journalist. This occurred due to an ATIP clerk mistakenly switching cover letters for two different response packages. The disclosed information included names, addresses, and details of donations. The CBC refused the CRA's requests to return the information, leading the CRA to initiate legal action. The OPC found that the CRA disclosed personal information without consent, contravening the Privacy Act. While the OPC noted the CRA's immediate remedial actions and action plan, it concluded that the disclosure did not meet the requirements of the Act.

• Whether the inadvertent mailing of personal information to a journalist constituted a disclosure without consent under the Privacy Act
• Whether the information disclosed was 'personal information' as defined by section 3 of the Privacy Act
• Whether the disclosure met the requirements of section 8 of the Privacy Act

A former RCMP member complained that the RCMP inappropriately collected her personal medical and financial information from Veterans Affairs Canada (VAC) after she was awarded a disability pension. The complainant alleged that the RCMP's National Compensation Policy Centre had no need for this sensitive information. The OPC found that the 2002 Memorandum of Understanding (MOU) between the RCMP and VAC transferred responsibility for pension administration to VAC, meaning the RCMP's National Compensation Policy Centre did not require the detailed medical diagnosis or financial information. The OPC concluded that the collection of this information by the RCMP was not for a purpose consistent with section 4 of the Privacy Act. The complaint was found to be well-founded, and the OPC recommended updating the MOU and reviewing RCMP's internal policies on access to medical records.

• Whether the collection of the complainant's financial information by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of the complainant's medical diagnosis/pensioned disability by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of the complainant's disability percentage by the RCMP was necessary and related directly to an operating program or activity under section 4 of the Privacy Act
• Whether the collection of personal information by the RCMP's National Compensation Policy Centre was consistent with the RCMP's own internal policies restricting access to sensitive medical information
• Whether the MOU between VAC and the RCMP adequately addressed information sharing practices for sensitive personal information

A former RCMP member complained that Veterans Affairs Canada (VAC) inappropriately disclosed her medical diagnosis, disability percentage, and financial information to the RCMP's National Compensation Policy Centre. VAC argued the disclosure was a 'consistent use' under the Privacy Act, citing the RCMP's responsibility for members' health services and an MOU between the two institutions. The OPC found that the information provided to the complainant at the time of application was inadequate to establish informed consent for such disclosure. Furthermore, the MOU did not explicitly authorize the sharing of detailed medical and financial information with the RCMP's National Compensation Policy Centre. The OPC concluded that the disclosure was not a consistent use and therefore contravened the Privacy Act, noting the systemic nature of this issue affecting many RCMP employees.

• Whether the disclosure of the complainant's medical and financial information by VAC to the RCMP was authorized by consent under subsection 8(1) of the Privacy Act
• Whether the disclosure of the complainant's medical and financial information by VAC to the RCMP was for a consistent use under paragraph 8(2)(a) of the Privacy Act
• Whether the information provided to disability pension applicants by VAC was sufficient to establish informed consent for disclosure to the RCMP
• Whether the Memorandum of Understanding (MOU) between VAC and the RCMP authorized the detailed sharing of personal medical and financial information
• Whether the RCMP's National Compensation Policy Centre had a 'need to know' the complainant's detailed medical and financial information

An employee of the Canada Border Services Agency (CBSA) complained on behalf of colleagues that the CBSA was using video monitoring to collect personal information for the purpose of monitoring employee conduct and performance, beyond the original safety and security purposes. The complainant also alleged insufficient signage. The OPC found the signage issue was resolved early in the investigation as the CBSA added more signs. Regarding the use of video for monitoring conduct and performance, the CBSA updated its policy to clarify that video technology would not be used for performance monitoring. The OPC accepted the CBSA's rationale for using video recordings to investigate serious misconduct, finding it met the standard for collection under section 4 of the Privacy Act. However, the resolution was conditional on the CBSA providing updated guidelines for implementing its policy.

• Whether the CBSA's use of video monitoring for employee conduct and performance monitoring contravened the Privacy Act
• Whether the collection of personal information via video technology was necessary and related directly to an operating program or activity of the institution under section 4 of the Privacy Act
• Whether the CBSA had sufficient signage to inform employees of video monitoring

A complainant alleged that his Internet service provider (ISP) disclosed his personal information without consent to a newspaper columnist. The complainant had contacted the columnist for assistance in resolving a service dispute with the ISP. The ISP argued it had implied consent to disclose information relevant to the dispute. The OPC found that the personal information disclosed was not sensitive and that, given the complainant's actions and familiarity with the columnist's work, it was reasonable for the ISP to infer implied consent. The ISP also limited its disclosure to information relevant to the complaint. Therefore, the OPC concluded that the complaint was not well-founded.

• Whether the ISP had the complainant's consent to disclose information to the newspaper columnist
• Whether the personal information disclosed was sensitive
• Whether implied consent was appropriate in the circumstances
• Whether the ISP limited its disclosure to relevant information

An individual complained that an equipment store required a scanned copy of his driver's license and a photograph as a condition for renting equipment. The store justified this practice by citing past losses of expensive rental equipment. The OPC informed the store that collecting driver's license information in this manner was generally inappropriate due to the excessive personal information contained on the license and its limited value in theft investigations. The OPC provided guidance on appropriate collection practices. As a result of the OPC's intervention, the store implemented a less privacy-invasive solution and trained its staff. The complainant was satisfied with the outcome.

• Whether requiring a scanned copy of a driver's license and a photograph for equipment rental constitutes appropriate collection of personal information under PIPEDA
• Whether the collection of driver's license information is justified for addressing customer theft

The Canada School of Public Service (the School) received a letter from the Public Sector Integrity Commissioner (PSIC) detailing allegations of wrongdoing against seven employees. The School then hand-delivered copies of this letter, which identified the seven individuals and the alleged wrongdoings, to each of the named employees. One of these employees complained to the OPC, alleging that the disclosure of his name via this letter violated the Privacy Act. The OPC found the complaint to be well-founded, concluding that the School had improperly disclosed personal information. Following the OPC's recommendations, the School developed new procedures to protect the confidentiality of information related to the Public Servants Disclosure Protection Act and a plan for addressing privacy breaches.

• Whether the Canada School of Public Service disclosed personal information contrary to the Privacy Act by hand-delivering a letter from the Public Sector Integrity Commissioner to employees named in it

The Canadian Council for Refugees complained that the Canada Border Services Agency (CBSA) improperly disclosed an individual's personal information on its "Wanted by the CBSA" website. The program aimed to solicit public help in locating individuals with Canada-wide warrants for removal, including those accused of war crimes. The OPC found that while the disclosure of personal information was permissible under the Privacy Act as a consistent use for immigration law enforcement, the CBSA failed to ensure the information was accurate, up-to-date, and complete. Specifically, the website implied a conviction for war crimes when the individual was only deemed inadmissible under immigration law. This led to a well-founded finding regarding the accuracy of the information. The CBSA accepted five recommendations, including revisiting the amount of personal information disclosed, clarifying the distinction between criminal conviction and immigration determination, and improving the timely removal of profiles.

• Whether the disclosure of personal information on the "Wanted by the CBSA" website was permissible under the Privacy Act as a consistent use
• Whether the CBSA took all reasonable steps to ensure the personal information was accurate, up-to-date, and complete as required by the Privacy Act
• Whether the CBSA should have conducted a Privacy Impact Assessment before launching the program

A complaint was filed on behalf of RCMP members regarding the disclosure of informal disciplinary records to the Crown, arguing it was inconsistent with the Supreme Court's R. v. McNeil decision. The complainant contended that only records from formal disciplinary hearings should be disclosed. The RCMP maintained that both formal and informal misconduct records could be relevant under McNeil, and the OPC agreed with this interpretation, finding the complaint not well-founded. However, the OPC expressed serious concerns about the RCMP's policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services. The OPC recommended the RCMP reconsider its retention policies, but the RCMP indicated it would continue its current practice.

• Whether the disclosure of informal disciplinary records to the Crown is consistent with R. v. McNeil
• Whether the RCMP's retention period for disciplinary records is appropriate