Federal (Canada) privacy & access decisions

An individual complained that an insurance company required overly broad consent for the collection, use, and disclosure of personal information when applying for life insurance. The OPC found the company's actual practices were compliant with PIPEDA. However, the company acknowledged the complainant's concerns about the clarity and precision of its consent language. The company agreed to revise its consent forms and share the updated language with the complainant for feedback. The complainant was satisfied with the company's explanation and its commitment to review the consent language. The complaint was settled during the investigation.

• Whether the insurance company's consent language was overly broad
• Whether the insurance company's collection, use, and disclosure practices were consistent with PIPEDA

A complainant's laptop, returned for repair, was sold by a retail store with her personal information still on it. The individual who purchased the laptop contacted the complainant, raising concerns about the store's safeguards. The investigation revealed an employee sold the returned laptop without wiping its data. The company retrieved the laptop and returned it to the complainant. In response, the store implemented new procedures to ensure all customer data is wiped from returned electronic devices, with documentation required for these actions. The complainant was satisfied with these changes, and the complaint was settled.

• Whether the retail store adequately safeguarded the complainant's personal information on a returned laptop
• Whether the retail store's practices led to an unauthorized disclosure of personal information

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without consent. The OPC's investigation found merit in the complaint. The lending institution agreed to apologize to the complainant and adjust her outstanding loan. Furthermore, the OPC noted the institution lacked privacy policies and practices. The institution committed to implementing privacy policies, establishing a privacy committee, providing employee training, and reminding staff about limiting information disclosure during debt recovery. Both the complainant and the OPC were satisfied with these actions.

• Whether the lending institution disclosed personal information without consent
• Whether the lending institution had adequate privacy policies and practices in place

A former employee complained that his previous employer, a trucking company, disclosed his personal information to other trucking firms after his employment ended. While the original complaint focused on the disclosure, the Office of the Privacy Commissioner (OPC) also identified the absence of a company privacy policy and a designated privacy representative as issues. Through discussions, both parties reached a settlement. The trucking company agreed to develop privacy policies and procedures, which it subsequently provided to the OPC, and also appointed a privacy officer. The complaint was settled during the investigation.

• Whether a trucking company disclosed personal information about a former employee to other firms without authorization
• Whether the trucking company had adequate privacy policies and procedures in place
• Whether the trucking company had a designated privacy officer

A doctor complained that a professional organization ignored his request for access to his personal information. The complainant believed he was the subject of a planned conference talk by a member of the organization and sought access to information related to this presentation. The OPC confirmed that the organization had not acted on the access request. However, the OPC also found that the presentation was never given, and therefore the organization held no personal information about the doctor. The complainant was satisfied with this explanation and withdrew his complaint.

• Whether the professional organization failed to respond to an access request
• Whether the professional organization held personal information about the complainant

An employee of a national transportation company complained about the security of personal information in an automated crew management system. The complainant was concerned that unauthorized personnel, particularly union representatives, could access sensitive data like date of birth, social insurance number, wage rates, and vacation eligibility. While some information was not accessible to union representatives, the company agreed to modify the system. The adjustments ensured that screens would no longer display Social Insurance Numbers, birth dates, and health information. As the complainant's concerns were addressed, the case was considered settled.

• Whether employee personal information in an automated crew management system was adequately protected from unauthorized access
• Whether union representatives had unauthorized access to sensitive employee personal information

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers about its practice of sharing data with affiliates for marketing, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The company maintained that its privacy policy, code, and activation process provided a sufficient basis for customer knowledge and consent, and that it complied with CRTC restrictions on disclosing personal information. The investigation found that the company's privacy documents and activation process constituted a reasonable effort to advise individuals of secondary purposes and that customers could refuse or withdraw consent. The Assistant Commissioner concluded that the company was in compliance with PIPEDA.

• Whether the telecommunications company obtained adequate knowledge and consent for the collection, use, or disclosure of personal information for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection as per Principle 4.2.3
• Whether the company made a reasonable effort to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the form of consent sought by the organization was appropriate given the circumstances and type of information, considering Principle 4.3.4
• Whether the reasonable expectations of the individual were considered in obtaining consent, as per Principle 4.3.5

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, and disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers of these practices or provide an easy opt-out mechanism. The investigation found that while the company had a privacy policy available online and in booklets, it did not actively bring these practices to the attention of new customers during the service application process. The Assistant Commissioner determined that the company's practices did not meet the reasonable expectations of its customers and thus contravened several PIPEDA principles. The complaint was found to be well-founded, and the Assistant Commissioner recommended that the company draw customers' attention to its privacy policy and options at the time of collection.

• Whether the telecommunications company obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection under Principle 4.2.3
• Whether the company made reasonable efforts to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the company's consent practices met the reasonable expectations of the individual under Principle 4.3.5

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

A complaint was made against a transportation company alleging that its sales agents were collecting passengers' date of birth and citizenship for Toronto-to-New York train bookings and disclosing this information to US Customs and US Naturalization and Immigration Service. The company confirmed this practice, stating it was an agreement with US authorities to minimize border delays. The OPC found that sales agents were representing the provision of this information as a requirement. The OPC advised the company to instruct its agents to present the provision of this information as voluntary and to seek consent after booking. The company issued a directive to its sales agents, and the OPC closed the file, subject to monitoring.

• Whether the transportation company was collecting personal information without proper consent
• Whether the transportation company was disclosing personal information without proper consent
• Whether sales agents were misrepresenting the voluntary nature of providing personal information

The complainant alleged that a federal institution failed to respond to an access request within the statutory 30-day period or an extended period, resulting in a deemed refusal under subsection 10(3) of the Access to Information Act. The complainant submitted their complaint on January 21, 2025, arguing that the deemed refusal was 'ongoing' and therefore the 60-day time limit for complaints under section 31 should not apply from the initial awareness date. The OIC requested clarification on when the complainant first became aware of the institution's failure to respond, but the complainant maintained their 'ongoing refusal' position. The OIC determined that the complaint was inadmissible because it was not submitted within the mandatory 60-day time limit from when the complainant first became aware of the grounds for complaint. The Commissioner rejected the argument that an 'ongoing' deemed refusal continuously restarts the complaint period, citing Federal Court precedent and emphasizing that the Act does not grant the Commissioner power to extend this time limit.

• Whether the complaint was submitted within the 60-day time limit prescribed by section 31 of the Access to Information Act
• Whether an 'ongoing' deemed refusal under subsection 10(3) of the Act continuously restarts the 60-day complaint period under section 31
• Whether the Information Commissioner has the power to extend the 60-day time limit for submitting complaints

The Information Commissioner ceased investigation into seventeen complaints, finding them vexatious. The complaints alleged unreasonable time extensions taken by an institution. However, the Commissioner found that these seventeen requests sought the same information as a previous request from the same complainant, which had already been the subject of an OIC investigation where the time extension was deemed reasonable. The complainant had not pursued a Federal Court review of the previous finding. Evidence showed the institution was providing regular interim responses as committed, contrary to the complainant's assertion. The Commissioner concluded that the new complaints were an attempt to circumvent the OIC's previous findings and avoid the proper recourse mechanism of Federal Court review. Therefore, the Commissioner ceased investigation under paragraphs 30(4)(a) and (b) of the Access to Information Act.

• Whether the complaints were vexatious under s.30(4)(a) ATIA
• Whether further investigation was unnecessary under s.30(4)(b) ATIA
• Whether the new requests were substantively duplicative of a previously investigated complaint
• Whether the complainant was attempting to circumvent previous OIC findings

The complainant submitted an access to information request to a federal institution and received a response in October 2021. The institution's response included a notice informing the complainant of their right to complain to the Information Commissioner within sixty days. The complainant filed a complaint with the Office of the Information Commissioner (OIC) in January 2022, which was more than sixty days after receiving the institution's response. The OIC determined that the complaint was submitted outside the mandatory 60-day timeframe specified in section 31 of the Access to Information Act. Citing legal precedents, the Commissioner concluded that the OIC does not have the authority to extend statutory timeframes. Consequently, the complaint was rejected.

• Whether the complaint was filed within the 60-day statutory timeframe as per s.31 of the Access to Information Act
• Whether the Information Commissioner has the authority to extend the statutory timeframe for filing a complaint

A federal institution applied to the Information Commissioner for approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. The institution argued that it had already disclosed some of the requested information to the same requester through an informal request, and processing the formal request would be duplicative. The institution sought to limit the scope of the formal request by excluding the time period covered by the informal release. However, the Commissioner found that the institution did not adequately explain how the records would be duplicates, noting that the subject matter and type of records appeared different. The Commissioner also considered that the formal request might be seeking a present-day review of redactions applied to previously released records. Crucially, the institution failed to specify which criteria under subsection 6.1(1) (vexatious, bad faith, or abuse of right) it was relying on, nor did it provide sufficient evidence to support its claim of duplication meeting these criteria. Consequently, the Commissioner denied the application, requiring the institution to process the request.

• Whether the access request was vexatious under s.6.1(1) ATIA
• Whether the access request was made in bad faith under s.6.1(1) ATIA
• Whether the access request was an abuse of the right of access under s.6.1(1) ATIA
• Whether the institution provided sufficient evidence to support its s.6.1 application
• Whether the institution's application was complete according to OIC guidance