Federal (Canada) privacy & access decisions

An individual, claiming to be a beneficiary of two estates, sought access under PIPEDA to estate information from a legal firm that had acted as an agent for another firm administering the estates. The complainant requested information pertaining to himself as a beneficiary and general beneficiary entitlements. The legal firm initially failed to respond to the access requests, leading to a complaint with the OPC. The firm later responded, stating it held no personal information about the complainant and that neither he nor the estates were clients. The OPC found that the firm contravened PIPEDA by not responding within the 30-day time limit. However, the OPC also determined that the complainant was only entitled to access information specifically about himself, not general estate information, and was satisfied that the firm had conducted a reasonable search for his personal information. The complaint was deemed well-founded and resolved due to the firm's initial failure to respond.

• Whether a legal firm must respond to an access request within 30 days, even if it holds no personal information about the requester
• Whether a beneficiary of an estate is entitled under PIPEDA to access general estate information
• Whether the requested information (e.g., statements of accounts, money received, disbursements) constitutes the complainant's personal information under PIPEDA
• Whether the legal firm conducted a reasonable search for the complainant's personal information

An individual filed a complaint against a retailer, alleging that the retailer withheld access to her personal information, contravening subsection 8(3) and Principle 4.9 of PIPEDA. The complainant and retailer were involved in ongoing small claims court litigation, and the complainant stated the information was necessary for her case. The retailer refused access, citing litigation privilege and prior disclosure. The OPC declined to investigate the complaint, finding that the court's procedures provided a more appropriate means for the complainant to address the access issues. This decision was based on avoiding conflict with provincial court rules and ensuring judicious use of public resources.

• Whether the complaint could more appropriately be dealt with by means of a procedure provided for under the laws of a province under paragraph 12(1)(b) of PIPEDA
• Whether the retailer withheld access to personal information in contravention of subsection 8(3) of PIPEDA
• Whether the retailer withheld access to personal information in contravention of Principle 4.9 of Schedule 1 of PIPEDA

Three individuals complained that their dating profiles, containing sensitive medical information, posted on PositiveSingles.com appeared on numerous other affiliated dating websites without their knowledge or consent. The complainants were assured of privacy but found their profiles on sites targeting different demographics, causing distress. The OPC's investigation found that PositiveSingles.com, operated by SuccessfulMatch Inc., used a single database across a network of affiliated sites, making profiles automatically available. The OPC concluded that the organization failed to obtain meaningful consent for this use, lacked openness about its network structure, and had inadequate safeguards, as some personal information was accessible via search engines. Following the OPC's recommendations, SuccessfulMatch revamped its website to provide explicit information about the network, ensure informed consent at registration, and improve safeguards. The complaint was found well-founded and resolved due to these corrective measures.

• Whether PositiveSingles.com obtained meaningful consent for the use of personal information across its network of affiliated sites (Principle 4.3, 4.3.2, 4.3.5 PIPEDA)
• Whether PositiveSingles.com was sufficiently open about its personal information management policies and practices, particularly regarding its network structure (Principle 4.8, 4.8.1 PIPEDA)
• Whether PositiveSingles.com implemented adequate security safeguards to protect sensitive personal information from unauthorized access (Principle 4.7, 4.7.1 PIPEDA)
• Whether PositiveSingles.com's use of cookies, potentially for online behavioral advertising, required express consent given the sensitive nature of the information

An individual complained that Apple was using and sharing her unique device identifier (UDID) without her knowledge and consent for tracking and targeted advertising. The OPC determined that UDIDs, and later Advertising IDs (Ad IDs), constituted personal information because Apple could link them to identifiable individuals. While Apple's use of UDIDs for administrative purposes was deemed to have implied consent, the OPC initially found Apple's explanations for using and disclosing UDIDs for targeted advertising to be insufficient for meaningful consent. During the investigation, Apple phased out the use of UDIDs for advertising, introduced the resettable Ad ID, and improved its privacy policy explanations and opt-out mechanisms. Consequently, the OPC found that Apple's updated practices provided sufficient information for meaningful consent regarding the use and disclosure of Ad IDs for advertising. The complaint was found to be well-founded but resolved due to Apple's corrective actions.

• Whether Unique Device Identifiers (UDID) constitute personal information under PIPEDA.
• Whether Advertising Identifiers (Ad ID) constitute personal information under PIPEDA.
• Whether Apple obtained meaningful consent for its use of UDID for administration and maintenance purposes (Principle 4.3 PIPEDA).
• Whether Apple obtained meaningful consent for its use of UDID and Ad ID for targeted advertising purposes (Principle 4.3 PIPEDA).
• Whether Apple obtained meaningful consent for its disclosure of UDID and Ad ID to third-party app developers (Principle 4.3 PIPEDA).
• Whether Apple's explanations regarding the use and disclosure of UDID and Ad ID were sufficiently clear and understandable to ensure meaningful consent (Principle 4.3.2 PIPEDA).
• Whether the sensitivity of UDID and Ad ID in the context of user profiling and online behavioural advertising required express consent (Principle 4.3.6 PIPEDA).
• Whether the reasonable expectations of the individual were met regarding the use and disclosure of UDID and Ad ID (Principle 4.3.5 PIPEDA).

An individual complained that a property management company was over-collecting personal information on rental application forms, specifically requesting Social Insurance Numbers (SINs), driver's licence information, and banking details as a condition of application. The complainant also noted the absence of a privacy policy on the company's website. The OPC contacted the company, which stated its website was under construction and would include a privacy policy. The company used third-party generated forms and believed SINs were necessary for credit checks, a point the OPC disputed. The OPC suggested marking SIN requests as 'optional' and advised against collecting unique driver's licence numbers. The company committed to updating its forms and website, satisfying the complainant. The OPC later confirmed these changes were implemented.

• Whether the collection of Social Insurance Numbers (SINs) was appropriate
• Whether the collection of driver's licence numbers was appropriate
• Whether the collection of banking information was appropriate
• Whether the organization made its privacy policy readily available as required by PIPEDA

A bank customer complained after being asked to provide his driver's license to pick up a replacement credit card, despite having other identification on file and being known to staff. The bank initially cited anti-money laundering regulations (PCMLTFA) but later admitted this rationale was incorrect. The OPC investigated two issues: whether the bank improperly demanded to record information (collection) and whether it could explain the purpose of collection. Since the customer refused to provide his driver's license, no actual collection occurred, so that aspect of the complaint was not well-founded. However, the bank's inaccurate explanation for requesting the information contravened Principle 4.2.5. The bank revised its procedures and circulated new guidelines to staff, leading to a well-founded and resolved outcome for the latter issue.

• Whether the bank limited its collection of personal information to that which was necessary for the purposes identified by the organization (Principle 4.4 PIPEDA)
• Whether the bank ensured its employees were able to explain the purposes for which personal information was being collected (Principle 4.2.5 PIPEDA)

A landlord complained that a telecommunications firm disclosed his personal account information, including debt details, to his tenant without consent. The firm had merged the landlord's existing account with the tenant's new account because they shared the same address. This led to the firm demanding payment from the tenant for services he had not ordered and disclosing the landlord's information during collection attempts. The tenant then confronted the landlord, accusing him of debt evasion and threatening to vacate. The landlord filed a complaint with the OPC, alleging unauthorized disclosure of his personal information.

• Whether the telecommunications firm disclosed the landlord's personal information without consent
• Whether the firm was responsible for merging the accounts and the subsequent unauthorized disclosure

A Canadian Forces member complained that Veterans Affairs Canada (VAC) improperly disclosed the exact percentage of his disability pension to the Department of National Defence (DND) without his consent. This was the second such complaint from the same individual, with a similar complaint in 2008 having been found well-founded. The OPC's investigation found that an agreement between VAC and DND limited information sharing to five specific pieces of information, none of which included the disability percentage. VAC argued the disclosure was in the public interest under subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act, but the OPC found no evidence that the disclosure was deliberate or necessary for the complainant's treatment. The disclosure appeared to be an accidental forwarding of an internal email chain. The OPC found the complaint well-founded and made recommendations to VAC.

• Whether Veterans Affairs Canada disclosed personal information (disability pension percentage) to the Department of National Defence without consent
• Whether the disclosure was in accordance with the information-sharing agreement between VAC and DND
• Whether the disclosure was useful or necessary to facilitate the complainant's medical treatment
• Whether the disclosure qualified under the "public interest" provisions of subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act

A woman complained to the OPC after discovering her tax information, held by the Canada Revenue Agency (CRA), was inappropriately accessed by a CRA employee who was the common-law spouse of her ex-husband. The ex-husband subsequently used this information to seek an amendment to a child support arrangement. The CRA's internal investigation confirmed the unauthorized access and disclosure but took 13 months, and the complainant was never informed of the results. The OPC's investigation found the complaint to be well-founded, noting that while the CRA had a discipline policy, allegations of misconduct needed to be addressed more quickly. The OPC also highlighted the need for enhanced privacy training for employees with access to personal tax information.

• Whether the Canada Revenue Agency inappropriately disclosed personal tax information
• Whether the Canada Revenue Agency adequately responded to the internal investigation
• Whether the Canada Revenue Agency's policies and training were sufficient to protect personal information

An individual complained that Veterans Affairs Canada improperly collected his personal information. The individual had contacted Veterans Affairs and the National Capital Commission regarding a monument. Subsequently, a Veterans Affairs official searched the individual's email address on Google, finding a discussion page with personal information. The official then emailed the URL of this page to the entire email thread, stating the individual's email was "public domain." The OPC found that Veterans Affairs did not have a demonstrable need to collect the URL linking to the personal information. The collection of this URL was deemed a violation of the Privacy Act, as collected personal information must relate directly to an operating program or activity. The complaint was well-founded, and Veterans Affairs apologized and deleted the email from its systems.

• Whether the collection of a URL linking to publicly available personal information constitutes collection under the Privacy Act
• Whether the collected personal information related directly to an operating program or activity of Veterans Affairs Canada under section 4 of the Privacy Act

A man complained that Canada Post checked his credit rating when he requested an online change of address. The OPC investigated whether Canada Post's practice of using Equifax for identity verification in online change-of-address requests violated the Privacy Act. The OPC found that Canada Post has a legitimate need to confirm identity to prevent identity theft and that it does not conduct a credit verification. However, the OPC was concerned that individuals were not adequately informed about the sharing of their personal information with Equifax. Canada Post implemented the OPC's recommendations to improve transparency.

• Whether Canada Post's use of Equifax for identity verification constituted a credit check
• Whether Canada Post had the statutory authority to collect personal information for identity verification
• Whether individuals were adequately informed about the sharing of their personal information with Equifax

A woman complained that the Canada Revenue Agency (CRA) disclosed her personal information to a third party without her consent. The complainant, who had not updated her family name in the CRA system, was applying for an adjustment. A CRA employee, attempting to locate her in the system, sent a letter containing the complainant's Social Insurance Number and other personal information to her niece, who shared a similar name and address. The OPC found that this disclosure was due to human error, as the employee failed to follow established procedures for verifying addresses. The CRA acknowledged its mistake and implemented measures to prevent similar incidents. The complaint was found to be well-founded.

• Whether the Canada Revenue Agency disclosed personal information without consent
• Whether the disclosure was due to human error and failure to follow procedures

An individual complained that an RCMP staff sergeant inappropriately disclosed personal information about him at a community meeting. The sergeant, invited to discuss a decade-old murder case, named the complainant as a "person of interest" and stated he had declined a polygraph test. The complainant alleged he was not fully informed about the subject matter of the discussion. The RCMP presumed consent based on the complainant's attendance and assurances from community group representatives. The OPC found that the RCMP had a responsibility to actively obtain consent for the disclosure, rather than presuming it. The complaint was upheld as well-founded.

• Whether the RCMP inappropriately disclosed personal information about the complainant at a community meeting
• Whether the RCMP obtained valid consent for the disclosure of personal information

A complaint was filed on behalf of a refugee, alleging that personal information about him was disclosed to a National Post reporter. The refugee was a passenger on the 'Ocean Lady' and was later identified in a news story as a fugitive sought by INTERPOL. The complainant named four federal institutions as potentially responsible for the disclosure: the Canada Border Services Agency, the Canadian Security Intelligence Service, Citizenship and Immigration Canada, and the Royal Canadian Mounted Police. The OPC's investigation confirmed the individual was a wanted fugitive with publicly available INTERPOL information. Due to journalistic confidentiality, the OPC could not determine how the reporter obtained the information. In the absence of evidence, the OPC found no support for the allegation that any of the named institutions disclosed the information.

• Whether any of the named federal institutions disclosed personal information about a refugee to a newspaper reporter
• Whether the publicly available INTERPOL notice constituted a disclosure by the institutions

A Canadian woman complained after her personal information, including her passport and income tax assessment, was disclosed to a Bangladeshi man whose work permit application she was supporting. The woman had sent these documents via her MP to the Canadian High Commission in Dhaka. When the man's application was refused, the High Commission returned the entire file, including the woman's documents, to him. Citizenship and Immigration Canada acknowledged the disclosure was made without consent and should not have occurred. The OPC found the complaint to be well-founded and recommended that all High Commissions implement a system to distinguish and prevent the return of third-party documents to applicants.

• Whether Citizenship and Immigration Canada disclosed personal information without consent
• Whether the disclosure of personal information was in contravention of the Privacy Act