Federal (Canada) Privacy Decisions

This report details an incident where a fraudster impersonated an unknown individual to trick a financial institution's employees into revealing customer contact information. The fraudster then used this information to extract further personal details from approximately 100 customers, increasing their risk of identity theft. The financial institution took immediate steps to mitigate the breach, including offering credit monitoring and enhancing staff training.

• Effectiveness of internal controls to prevent unauthorized disclosure of personal information
• Adequacy of breach response and mitigation measures
• Risks of identity theft and fraud due to personal information disclosure

The complainant alleged an insurance company refused to provide her with access to her personal information, including a recording of a telephone conversation, and documents related to her complaint to the company's ombudsman office. The company claimed the ombudsman process was a "formal dispute resolution process" exempt from PIPEDA and that the process was not a "commercial activity." The OPC found the company contravened PIPEDA by unduly delaying access to the recorded conversation and by incorrectly withholding documents from the ombudsman process. The OPC determined the ombudsman office was not a "formal dispute resolution process" and its activities were subject to PIPEDA.

• Is an internal ombudsman office a "formal dispute resolution process" under PIPEDA?
• Are the services of an internal ombudsman office considered "commercial activity" under PIPEDA?
• Does an organization need spousal consent to release joint account information when third-party information can be severed?
• What are the obligations of an organization responding to an access to information request under PIPEDA?

An individual complained that a collection agency refused to provide access to their personal information, despite multiple written requests. The agency failed to respond to several of these requests within the timeframes required by PIPEDA. Although the agency eventually sent the information, and the individual refused to sign for it, the agency was deemed to have provided access. The agency acknowledged it did not follow its own procedures for handling access requests and committed to revising them and providing refresher training.

• Timeliness of response to access requests
• Failure to follow internal procedures for handling access requests
• Adequacy of providing access to personal information

Canada Post's collection of electronic signatures for mail tracking was investigated following a complaint. The OPC found that Canada Post's collection, use, and disclosure of signatures for tracking purposes complied with the Privacy Act, as it was consistent with the original purpose of collection and a permitted disclosure under paragraph 8(2)(a) of the Act. However, the OPC identified shortcomings in the security and privacy controls of Canada Post's online tracking website and made recommendations for improvement, which Canada Post accepted.

• Adequacy of notice provided to individuals regarding the collection, use, and disclosure of their electronic signatures.
• Compliance with the Privacy Act regarding the collection, use, and disclosure of personal information.
• Adequacy of security and privacy controls for digitized signatures displayed on Canada Post's online tracking website.

The OPC investigated a complaint concerning a cable provider that posted a list of customers with overdue accounts on a public Facebook page. The provider believed this was permissible, citing municipal practices of publishing names of those in property tax arrears. The OPC clarified that while PIPEDA permits disclosure of information for debt collection purposes to third parties, it does not authorize public dissemination without consent.

• Public dissemination of personal information for debt collection
• Application of PIPEDA's debt collection exemption
• Comparison of debt collection practices with municipal tax arrears publications

A customer complained that a retail store employee disclosed his personal information, including his name and in-store behaviour, to his employer without his knowledge or consent. The Office found that the disclosed information was personal information and that the store could not rely on implied consent for the disclosure, as the information was sensitive and disclosure to an employer was not a reasonable expectation. The matter was resolved after the store implemented recommendations to communicate its PIPEDA obligations.

• Whether information disclosed in a public store is personal information.
• Whether implied consent applied to the disclosure of sensitive personal information to an employer.
• Whether the disclosed information qualified as publicly available information under the regulations.

A telecommunications company erroneously continued to report a debt to a credit-reporting agency after the complainant was discharged from bankruptcy. This impacted the complainant's credit score and led to unwanted debt collection calls. The company investigated, corrected its records, notified the credit-reporting agency, and ensured the debt collection calls would cease.

• Accuracy and up-to-dateness of personal information
• Disclosure of personal information to third parties
• Appropriate use of personal information in decision-making

An employee complained that her pension and benefit provider improperly disclosed her unique identifier, failed to keep her address accurate, and did not implement adequate safeguards. An individual with the same name was mistakenly given the complainant's ID number, leading to her address being changed. Consequently, five mailings containing sensitive information were sent to the wrong address, and the complainant lost her life insurance coverage due to missed forms. The provider corrected the error and reinstated coverage.

• Disclosure of unique identifier to a third party without consent.
• Failure to maintain accurate client address information.
• Inadequate safeguards against unauthorized disclosure and modification of personal information.
• Improper authentication of caller identity.

An individual complained that a real estate management company failed to obtain consent for the collection of his personal information through video surveillance at a shopping mall. The complainant alleged inadequate signage and over-collection of his information when a camera was focused on him. The company responded by posting new signage and providing additional training to staff. The Office of the Privacy Commissioner discontinued the investigation, finding the company’s response to be fair and reasonable.

• Adequacy of signage for video surveillance
• Over-collection of personal information
• Consent to collection of personal information

An individual complained that an estimator, subcontracted by a roofing company, disclosed his personal information to another roofing company without consent. The investigation found that the second roofing company was responsible for its estimator's actions and that there was a disclosure of personal information in contravention of PIPEDA. The second roofing company implemented a recommendation to establish agreements with subcontractors regarding privacy policies and training.

• Whether the subcontractor's actions were attributable to the organization.
• Whether personal information was disclosed without consent.
• Whether the disclosure exceeded the purposes for which the information was collected.

An individual complained to the OPC after a retailer's delivery person texted her inappropriate comments after obtaining her number from a work phone and transferring it to a personal device. The complainant also felt the retailer mishandled her initial complaint. The OPC's involvement led the retailer to implement new procedures for faulty work phones, retrain employees on its privacy policy, and take disciplinary action against the delivery person. The complainant was satisfied with the resolution.

• Unauthorized use of customer personal information
• Handling of customer complaints
• Employee training on privacy policies

An individual complained that a car dealership could not provide details about its personal information handling practices when asked. The dealership employee copied the complainant's driver's license and credit card without adequately explaining why or what safeguards were in place. The dealership agreed to hold an employee review session to ensure staff are knowledgeable about privacy policies and practices.

• Adequacy of employee training on privacy policies
• Transparency regarding collection and use of personal information
• Responding to individual inquiries about personal information handling practices

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from an individual who alleged that a collection agency was pursuing him for a debt he did not owe and that inaccurate information was appearing on his credit report. The individual was unable to obtain validation of the debt from the agency. Following the OPC's intervention, the agency investigated, found discrepancies on the original credit application, ceased collection efforts, and agreed to correct the individual's credit report. The individual was satisfied with this resolution.

• Accuracy of personal information
• Access to personal information
• Debt collection practices
• Correction of credit reports

The complainant alleged that the RCMP inappropriately used employees' personal information during a training course. The RCMP used real personal information from 91 employees for a data entry exercise without their consent and without advising participants of the data's sensitive nature. The RCMP acknowledged the contravention of section 7 of the Privacy Act and notified the affected employees.

• Use of personal information for training purposes without consent
• Adequacy of notification to affected individuals
• Consistency of use with the original purpose of collection

The OPC discontinued further complaints against Globe24h.com concerning the collection, use, and disclosure of personal information from Canadian court and tribunal decisions. While initial complaints were found to be well-founded, additional complaints were discontinued as the issues had already been investigated and reported on. The matter was further resolved when the Federal Court ordered Globe24h to remove personal information from its website and the website subsequently ceased operations.

• Collection, use, and disclosure of personal information from public court decisions
• Consent for republishing personal information
• Discontinuance of investigation based on prior report
• Circumvention of privacy laws by republishing sensitive data