Federal (Canada) privacy & access decisions

A married couple applied for a joint mortgage. The husband alleged that a bank mortgage specialist disclosed his account information to his wife without his consent during the application process. The bank argued there was implicit consent given the joint mortgage application. The Assistant Commissioner found that the bank did not make a reasonable effort to inform the couple of the purposes for which their financial information would be disclosed to each other. Therefore, the bank did not have meaningful consent for the disclosure. Although the incident was a one-time error by an employee, the complaint was found to be well-founded and resolved as the bank had adopted reasonable practices.

• Whether the bank had the husband's implicit or explicit consent to disclose his account information to his wife
• Whether the bank made a reasonable effort to inform the couple of the purposes for which their financial information would be disclosed
• Whether the bank's mortgage specialist followed the bank's usual practice for informing joint mortgage applicants
• Whether the presumption of implied consent remained reasonable after the wife's reaction to the initial disclosure

The OPC investigated a complaint against the RCMP regarding the use and disclosure of personal information from the Canadian Firearms Program (CFP) to EKOS Research Associates Inc. for a survey of firearms licensees. The investigation examined whether the RCMP improperly used or disclosed personal information in contravention of sections 7 and 8 of the Privacy Act. The OPC found that the use of information for a client-satisfaction survey to improve CFP services was consistent with the original collection purpose, thus not contravening section 7. Furthermore, the disclosure to EKOS, acting as an agent under a contract with confidentiality and security provisions, did not contravene section 8. The complaint was therefore deemed not well-founded. The OPC noted that the CFP committed to updating its InfoSource entry and website to better inform the public about information use for surveys and acknowledged that a Privacy Impact Assessment would have been beneficial.

• Whether the use of personal information for a client-satisfaction survey was consistent with the purpose for which it was obtained or compiled under s.7(a) of the Privacy Act
• Whether the disclosure of personal information to EKOS Research Associates Inc. for the survey contravened s.8 of the Privacy Act
• Whether the personal information collected by the RCMP related directly to an operating program or activity of the institution under s.4 of the Privacy Act

The OPC investigated a complaint regarding the leak of a Canadian citizen's personal information from a DFAIT database, which was reported in the media in spring 2008. The investigation confirmed the information was held in an official consular record within DFAIT's computer system. A significant concern was that 1,231 DFAIT employees had access to these files, and the system lacked audit trail capabilities or mechanisms to restrict access to specific records. Consequently, the OPC could not identify the source of the leak. The complaint was found to be well-founded, and DFAIT agreed to implement corrective measures.

• Whether personal information was leaked from a DFAIT database
• Whether DFAIT's security safeguards were adequate to protect personal information
• Whether DFAIT's computer system had sufficient audit trail capabilities
• Whether DFAIT's computer system had mechanisms to restrict access to particular files

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by allegedly accessing her wireless Internet connection to post messages on a white supremacist website during an investigation. An Internet Service Provider, responding to a subpoena, linked an IP address associated with the alleged CHRC activity to the complainant. The OPC's investigation found no evidence that the CHRC collected, used, or disclosed any personal information about the complainant or was even aware of her prior to the tribunal hearing. Technological experts suggested the IP address association was a third-party mismatch. The complaint was found to be not well-founded.

• Whether the Canadian Human Rights Commission improperly collected and used the complainant's personal information
• Whether the CHRC accessed the complainant's wireless Internet connection
• Whether an IP address can be considered personal information

CIPPIC complained that Abika.com, a U.S. company, collected, used, and disclosed Canadians' personal information without consent, compiled and disclosed inaccurate personal information through its "psychological profile" service, and used personal information for inappropriate purposes. The OPC initially declined jurisdiction, but the Federal Court ordered the investigation to proceed. The OPC found that Abika collected and disclosed personal information, including telephone records, of Canadians without their knowledge or consent, often for inappropriate purposes such as investigating partners. While the OPC found the accuracy complaint not well-founded due to lack of verifiable evidence, it concluded that Abika contravened PIPEDA Principles 4.3 and subsection 5(3). Abika failed to respond adequately to the OPC's recommendations.

• Whether Abika collected, used, and disclosed personal information of individuals living in Canada without their knowledge and consent, in contravention of Principle 4.3
• Whether Abika compiled and disclosed inaccurate personal information through its "psychological profile" service, in contravention of Principle 4.6
• Whether Abika collected, used, and disclosed personal information about Canadians for inappropriate purposes, in contravention of subsection 5(3)

The Canadian Internet Policy and Public Interest Clinic (CIPPIC) filed a comprehensive complaint against Facebook Inc., alleging 24 contraventions of PIPEDA across 12 subjects, including default privacy settings, advertising practices, third-party applications, and the handling of personal information for deactivated, deceased, and non-users. The Office of the Privacy Commissioner (OPC) focused its investigation on meaningful consent, retention, and security safeguards. The Assistant Commissioner found several allegations to be 'not well-founded', such as those concerning new uses of information, collection from other sources, Facebook Mobile safeguards, and deception. Other allegations, including those related to date of birth collection, default privacy settings, advertising, and monitoring for anomalous activity, were found 'well-founded and resolved' due to Facebook's agreement to implement corrective measures. However, significant issues regarding third-party applications, indefinite retention of deactivated account data, inadequate notification for deceased users' accounts, and the collection/retention of non-users' personal information were found 'well-founded' but remained unresolved, as Facebook declined to implement key recommendations. The OPC indicated it would follow up on all recommendations and consider further action for unresolved issues.

• Whether requiring date of birth as a condition of registration contravened Principle 4.3.3
• Whether Facebook adequately explained the purposes for collecting and using date of birth under Principle 4.3.2
• Whether default privacy settings constituted improper opt-out consent for sensitive information under Principle 4.3.6
• Whether Facebook made reasonable efforts to advise users of purposes and extent of information use/disclosure via default settings under Principles 4.2.3 and 4.3.2
• Whether default settings for photo albums met users' reasonable expectations under Principle 4.3.5
• Whether default settings for public search listings met users' reasonable expectations under Principle 4.3.5
• Whether Facebook made reasonable efforts to notify users of advertising purposes under Principle 4.3.2
• Whether Social Ads improperly used opt-out consent for sensitive information under Principle 4.3.6
• Whether users could opt out of Facebook Ads under Principle 4.3.8
• Whether requiring consent to Facebook Ads as a condition of service violated Principle 4.3.3
• Whether Facebook adequately informed users of the purpose for disclosing personal information to third-party application developers under Principles 4.2.2 and 4.2.5
• Whether Facebook provided third-party application developers with access to personal information beyond what was necessary under Principle 4.4.1
• Whether Facebook required consent to disclosure beyond what was necessary to run an application under Principle 4.3.3
• Whether Facebook adequately safeguarded personal information transferred to third-party applications under Principle 4.7
• Whether Facebook obtained meaningful consent for disclosure of personal information to application developers when users or their friends added applications under Principles 4.2, 4.2.3, 4.3.2, 4.3.4, 4.3.5, 4.3.6, and subsection 5(3)
• Whether Facebook failed to notify users of new purposes for collecting, using, or disclosing personal information under Principle 4.2.4
• Whether Facebook failed to provide specific information and obtain meaningful consent for collecting personal information from sources outside Facebook under Principle 4.3
• Whether Facebook inappropriately deprived users of a means to delete all personal information from the site
• Whether Facebook's indefinite retention of personal information in deactivated accounts contravened Principles 4.5 and 4.5.3
• Whether Facebook obtained meaningful consent for memorializing deceased users' profiles under Principle 4.3.3
• Whether memorializing profiles was an unnecessary condition of service under Principle 4.3.3
• Whether Facebook adequately informed users of its practice of account memorialization under Principles 4.2.1, 4.2.3, 4.3.2, and 4.8
• Whether Facebook obtained consent from non-users for uploading their personal information (e.g., tagging, invitations) under Principle 4.3
• Whether Facebook's retention of non-users' email addresses beyond the initial purpose contravened Principle 4.5
• Whether Facebook Mobile's use of a persistent cookie constituted inadequate safeguarding of personal information under Principles 4.7, 4.7.1, and 4.7.3
• Whether Facebook adequately informed users of its practice of monitoring for anomalous activity under Principle 4.8
• Whether Facebook misrepresented its purpose or users' control over personal information under Principles 4.3.2 and 4.4.2

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless internet connection to post messages on a white supremacist website. The OPC investigated whether the CHRC contravened sections 4 to 8 of the Privacy Act. The investigation first determined that the complainant's IP address, when linked to her identity via a subpoena, constituted personal information under section 3 of the Act. However, the OPC found no evidence that the CHRC ever collected or had knowledge of the complainant's personal information prior to the allegations. Technological experts suggested the association of the complainant's IP address with the CHRC was likely a third-party mismatch. Consequently, the Assistant Privacy Commissioner concluded there was no contravention of the Privacy Act.

• Whether the complainant's IP address constituted personal information under section 3 of the Privacy Act
• Whether the CHRC collected the complainant's personal information
• Whether the CHRC improperly used, disclosed, or retained the complainant's personal information in contravention of sections 4 to 8 of the Privacy Act