Federal (Canada) privacy & access decisions

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The service allowed individuals to redirect mail and, with an opt-out clause in fine print, permitted Canada Post to supply new addresses to "mailers" for a fee. The Commissioner found that Canada Post failed to clearly inform customers that their personal information was being sold to organizations like list brokers and direct marketers, and that the consent obtained was not meaningful. Canada Post refused to implement a recommendation for an opt-in checkbox for this disclosure. The Commissioner concluded that Canada Post was in contravention of sections 5(2) and 8 of the Privacy Act for failing to plainly identify the purpose of collection and for disclosing personal information without proper consent.

• Whether Canada Post adequately informed individuals about the purpose of collecting their new address information for the NCOA service, specifically regarding disclosure to "mailers" for commercial purposes under s.5(2) of the Privacy Act
• Whether Canada Post obtained valid consent for the disclosure of new addresses to mass mailers and direct marketers under s.8 of the Privacy Act
• Whether the "opt-out" mechanism used by Canada Post constituted meaningful consent
• Whether the safeguard of only providing new addresses to mailers who already had the customer's name and old address adequately addressed consent concerns