Federal (Canada) privacy & access decisions

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

The federal Privacy Commissioner investigated a complaint regarding Centurion Security Services' installation of surveillance cameras at a downtown Yellowknife intersection. The Commissioner found that both live and recorded video images of individuals constitute "personal information" under PIPEDA. Centurion Security Services, a private company, was monitoring public spaces for commercial purposes without the consent of individuals, which contravened Principle 4.3 of Schedule 1 and section 5(1) of the Act. Although the cameras were removed before the complaint was received, the Commissioner concluded that Centurion's intended future public video surveillance for commercial purposes would also be unlawful. The complaint was found to be well-founded.

• Whether the subject matter falls within the Commissioner's jurisdiction under PIPEDA
• Whether live video pictures of individuals constitute "personal information" under section 2 of PIPEDA
• Whether the collection of personal information was in the course of a commercial activity under section 4 of PIPEDA
• Whether Centurion Security Services collected personal information without consent in contravention of Principle 4.3 of Schedule 1 of PIPEDA
• Whether the absence of recording (live feed only) affects the classification of information as personal information or the requirement for consent

A complaint was made against a transportation company alleging that its sales agents were collecting passengers' date of birth and citizenship for Toronto-to-New York train bookings and disclosing this information to US Customs and US Naturalization and Immigration Service. The company confirmed this practice, stating it was an agreement with US authorities to minimize border delays. The OPC found that sales agents were representing the provision of this information as a requirement. The OPC advised the company to instruct its agents to present the provision of this information as voluntary and to seek consent after booking. The company issued a directive to its sales agents, and the OPC closed the file, subject to monitoring.

• Whether the transportation company was collecting personal information without proper consent
• Whether the transportation company was disclosing personal information without proper consent
• Whether sales agents were misrepresenting the voluntary nature of providing personal information