Federal (Canada) privacy & access decisions

A client sought access to her personal information from her former lawyer. The lawyer refused access, citing outstanding fees and asserting a solicitor's lien on the client's file, believing that providing access could jeopardize payment. The OPC noted that PIPEDA's subsection 9(3) provides an exhaustive list of reasons for refusing access, which does not include a solicitor's lien. Therefore, lawyers must grant access to personal information even if a valid lien exists. The OPC suggested that allowing the individual to view, but not copy, the information could balance the right to access with the lien. The lawyer subsequently provided a complete copy of the file, and the complaint was settled.

• Whether a solicitor's lien is a valid ground to refuse access to personal information under PIPEDA
• Whether subsection 9(3) of PIPEDA provides an exhaustive list of circumstances for refusing access

The Privacy Commissioner of Canada launched an investigation into SWIFT SCRL following allegations that it disclosed personal information originating from or transferred to Canadian financial institutions to the US Department of the Treasury (UST) via administrative subpoenas. SWIFT provides messaging services to financial institutions globally, and some messages contain personal information. The Commissioner determined that SWIFT was subject to PIPEDA due to its operations and significant presence in Canada. While acknowledging SWIFT's compliance with US laws, the Commissioner found that SWIFT had not contravened PIPEDA, as the Act allows for disclosure without consent in response to a subpoena from a body with jurisdiction to compel information. The Commissioner emphasized that organizations operating in Canada must still abide by PIPEDA, even when subject to foreign laws. She also recommended that US authorities use existing information-sharing mechanisms with built-in privacy protections rather than subpoenas for Canadian-related financial information.

• Whether SWIFT is subject to PIPEDA
• Whether SWIFT contravened PIPEDA by disclosing personal information to the US Department of the Treasury
• Whether the exception to consent for disclosures in response to a subpoena applies

An individual complained that a department store's method of collecting tax exemption information allowed other customers to view her personal data and the data of previous customers. The store used a petition-style form where customers wrote their names, shopping dates, and tax exemption numbers, making this information visible to subsequent customers. The complainant was concerned about the lack of privacy for her personal information. In response to the complaint, the department store first implemented a temporary measure of using a new form where only one customer's information appeared per page. Subsequently, the store reconfigured its cash registers to electronically print a receipt-style form for tax exemptions, which was then completed by the customer and securely stored in the register. This new electronic system prevented customers from viewing each other's personal information. The complainant was satisfied with these changes, and the matter was considered settled.

• Whether the department store's method of collecting tax exemption information allowed unauthorized disclosure of personal information to other customers
• Whether the department store adequately safeguarded customers' personal information