Federal (Canada) privacy & access decisions

A landlord complained that a telecommunications firm disclosed his personal account information, including debt details, to his tenant without consent. The firm had merged the landlord's existing account with the tenant's new account because they shared the same address. This led to the firm demanding payment from the tenant for services he had not ordered and disclosing the landlord's information during collection attempts. The tenant then confronted the landlord, accusing him of debt evasion and threatening to vacate. The landlord filed a complaint with the OPC, alleging unauthorized disclosure of his personal information.

• Whether the telecommunications firm disclosed the landlord's personal information without consent
• Whether the firm was responsible for merging the accounts and the subsequent unauthorized disclosure

A Canadian Forces member complained that Veterans Affairs Canada (VAC) improperly disclosed the exact percentage of his disability pension to the Department of National Defence (DND) without his consent. This was the second such complaint from the same individual, with a similar complaint in 2008 having been found well-founded. The OPC's investigation found that an agreement between VAC and DND limited information sharing to five specific pieces of information, none of which included the disability percentage. VAC argued the disclosure was in the public interest under subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act, but the OPC found no evidence that the disclosure was deliberate or necessary for the complainant's treatment. The disclosure appeared to be an accidental forwarding of an internal email chain. The OPC found the complaint well-founded and made recommendations to VAC.

• Whether Veterans Affairs Canada disclosed personal information (disability pension percentage) to the Department of National Defence without consent
• Whether the disclosure was in accordance with the information-sharing agreement between VAC and DND
• Whether the disclosure was useful or necessary to facilitate the complainant's medical treatment
• Whether the disclosure qualified under the "public interest" provisions of subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act

An inmate complained that the Correctional Service of Canada (CSC) contravened the Privacy Act by openly posting details of medical appointments. The postings included his name, appointment time, and partial offender number, which were visible to the general penitentiary population. The inmate also alleged similar disclosures for other inmates, including complete offender numbers and other medical information. The CSC acknowledged the breach and committed to notifying inmates individually rather than posting lists. However, the CSC did not agree to use only partial offender numbers on internal employee lists for notifications. The OPC upheld the complaint as well-founded.

• Whether the open posting of inmate medical appointment details constituted an unauthorized disclosure of personal information under the Privacy Act
• Whether the Correctional Service of Canada contravened the Privacy Act by disclosing inmate names, appointment times, and offender numbers to the general penitentiary population

A woman complained that the Canada Revenue Agency (CRA) disclosed her personal information to a third party without her consent. The complainant, who had not updated her family name in the CRA system, was applying for an adjustment. A CRA employee, attempting to locate her in the system, sent a letter containing the complainant's Social Insurance Number and other personal information to her niece, who shared a similar name and address. The OPC found that this disclosure was due to human error, as the employee failed to follow established procedures for verifying addresses. The CRA acknowledged its mistake and implemented measures to prevent similar incidents. The complaint was found to be well-founded.

• Whether the Canada Revenue Agency disclosed personal information without consent
• Whether the disclosure was due to human error and failure to follow procedures

An individual complained that an RCMP staff sergeant inappropriately disclosed personal information about him at a community meeting. The sergeant, invited to discuss a decade-old murder case, named the complainant as a "person of interest" and stated he had declined a polygraph test. The complainant alleged he was not fully informed about the subject matter of the discussion. The RCMP presumed consent based on the complainant's attendance and assurances from community group representatives. The OPC found that the RCMP had a responsibility to actively obtain consent for the disclosure, rather than presuming it. The complaint was upheld as well-founded.

• Whether the RCMP inappropriately disclosed personal information about the complainant at a community meeting
• Whether the RCMP obtained valid consent for the disclosure of personal information

A woman complained that her personal information, specifically positive drug test results from an ion scan during a prison visit, was inappropriately disclosed to her ex-husband, a Correctional Service of Canada (CSC) employee. Her ex-husband used this information to deny her access to their children. While CSC investigated and found that the ex-husband did not directly access the database, they did not determine how he obtained the information. The OPC's investigation confirmed that the drug test results were indeed disclosed to the ex-husband by other CSC employees, though the specific individuals responsible could not be identified. The OPC found that CSC failed to adequately address the core disclosure issue.

• Whether the woman's personal information (drug test results) was inappropriately disclosed to her ex-husband
• Whether Correctional Service of Canada adequately dealt with the disclosure issue

The adult children of a deceased veteran sought access to their father's pension file from Veterans Affairs Canada to administer his estate. Veterans Affairs refused, citing a 20-year protection period under the Pension Act and the children's ineligibility for pension benefits. The children complained to the OPC, arguing the documents were necessary to determine if pension entitlements were fully paid and if the claim was processed in bad faith. The OPC found it unreasonable for Veterans Affairs to dictate estate information needs. The OPC concluded that under the Privacy Act's Regulations, the complainants were entitled to the file for estate administration. The complaint was upheld as well-founded, and Veterans Affairs subsequently released the file.

• Whether Veterans Affairs Canada was justified in withholding a deceased veteran's pension file from his adult children
• Whether the Pension Act's 20-year protection period for personal information overrides the need for estate administration
• Whether the Privacy Act's Regulations entitle complainants to a deceased pensioner's file for estate administration

A man complained that Canada Post checked his credit rating when he requested an online change of address. The OPC investigated whether Canada Post's practice of using Equifax for identity verification in online change-of-address requests violated the Privacy Act. The OPC found that Canada Post has a legitimate need to confirm identity to prevent identity theft and that it does not conduct a credit verification. However, the OPC was concerned that individuals were not adequately informed about the sharing of their personal information with Equifax. Canada Post implemented the OPC's recommendations to improve transparency.

• Whether Canada Post's use of Equifax for identity verification constituted a credit check
• Whether Canada Post had the statutory authority to collect personal information for identity verification
• Whether individuals were adequately informed about the sharing of their personal information with Equifax

A woman complained to the OPC after discovering her tax information, held by the Canada Revenue Agency (CRA), was inappropriately accessed by a CRA employee who was the common-law spouse of her ex-husband. The ex-husband subsequently used this information to seek an amendment to a child support arrangement. The CRA's internal investigation confirmed the unauthorized access and disclosure but took 13 months, and the complainant was never informed of the results. The OPC's investigation found the complaint to be well-founded, noting that while the CRA had a discipline policy, allegations of misconduct needed to be addressed more quickly. The OPC also highlighted the need for enhanced privacy training for employees with access to personal tax information.

• Whether the Canada Revenue Agency inappropriately disclosed personal tax information
• Whether the Canada Revenue Agency adequately responded to the internal investigation
• Whether the Canada Revenue Agency's policies and training were sufficient to protect personal information

A complaint was filed on behalf of a refugee, alleging that personal information about him was disclosed to a National Post reporter. The refugee was a passenger on the 'Ocean Lady' and was later identified in a news story as a fugitive sought by INTERPOL. The complainant named four federal institutions as potentially responsible for the disclosure: the Canada Border Services Agency, the Canadian Security Intelligence Service, Citizenship and Immigration Canada, and the Royal Canadian Mounted Police. The OPC's investigation confirmed the individual was a wanted fugitive with publicly available INTERPOL information. Due to journalistic confidentiality, the OPC could not determine how the reporter obtained the information. In the absence of evidence, the OPC found no support for the allegation that any of the named institutions disclosed the information.

• Whether any of the named federal institutions disclosed personal information about a refugee to a newspaper reporter
• Whether the publicly available INTERPOL notice constituted a disclosure by the institutions

A Canadian woman complained after her personal information, including her passport and income tax assessment, was disclosed to a Bangladeshi man whose work permit application she was supporting. The woman had sent these documents via her MP to the Canadian High Commission in Dhaka. When the man's application was refused, the High Commission returned the entire file, including the woman's documents, to him. Citizenship and Immigration Canada acknowledged the disclosure was made without consent and should not have occurred. The OPC found the complaint to be well-founded and recommended that all High Commissions implement a system to distinguish and prevent the return of third-party documents to applicants.

• Whether Citizenship and Immigration Canada disclosed personal information without consent
• Whether the disclosure of personal information was in contravention of the Privacy Act

An individual complained that Veterans Affairs Canada improperly collected his personal information. The individual had contacted Veterans Affairs and the National Capital Commission regarding a monument. Subsequently, a Veterans Affairs official searched the individual's email address on Google, finding a discussion page with personal information. The official then emailed the URL of this page to the entire email thread, stating the individual's email was "public domain." The OPC found that Veterans Affairs did not have a demonstrable need to collect the URL linking to the personal information. The collection of this URL was deemed a violation of the Privacy Act, as collected personal information must relate directly to an operating program or activity. The complaint was well-founded, and Veterans Affairs apologized and deleted the email from its systems.

• Whether the collection of a URL linking to publicly available personal information constitutes collection under the Privacy Act
• Whether the collected personal information related directly to an operating program or activity of Veterans Affairs Canada under section 4 of the Privacy Act

An imposter gained access to the complainant's cell phone account by social engineering a customer service representative (CSR). The CSR disclosed personal information, including PIN, billing, and call history, and made changes to the account. The complainant also alleged inadequate response to an access request for call recordings and transcripts. The OPC found the disclosure of personal information to the imposter to be well-founded, as the company's authentication procedures were not followed, contravening Principle 4.3. The access complaint was found well-founded because the company initially failed to respond within the 30-day timeframe, but it was resolved as the company eventually provided the requested information. The OPC recommended the company review its privacy management programs, policies, and procedures.

• Whether the cellular service provider disclosed personal information without consent to an imposter, contravening Principle 4.3 PIPEDA
• Whether the cellular service provider adequately responded to the complainant's access request for personal information under Principle 4.9 PIPEDA
• Whether the cellular service provider responded to the access request within the 30-day timeframe as per s.8(3) PIPEDA
• Whether the redaction of the CSR's name from the transcript was permissible under s.9(1) PIPEDA
• Whether the company was required to provide an audio recording of the conversation in addition to a transcript under s.10 PIPEDA

A complainant alleged that a telecommunications firm failed to provide her with access to her personal information, specifically notes and transcripts of recorded conversations related to an account dispute. The firm acknowledged receiving the access request but mistakenly believed it was not necessary to provide the information due to ongoing settlement negotiations. The OPC found that the firm failed to respond to the access request within 30 days and did not issue an extension notice, thus contravening PIPEDA subsections 8(3), 8(4), and 8(5). Furthermore, the firm purged the requested audio records, violating subsection 8(8) and Principles 4.9 and 4.9.4. The firm's internal policies were found to be unclear and staff training inadequate, leading to the erroneous deletion of records. The OPC made several recommendations, which the firm accepted and implemented, including amending policies and providing staff training. As a result, the complaint was deemed well-founded and resolved.

• Whether the telecommunications firm responded to the access request within the 30-day time limit under subsection 8(3) PIPEDA
• Whether the telecommunications firm issued a notice of extension for the access request under subsection 8(4) PIPEDA
• Whether the telecommunications firm was deemed to have refused the access request under subsection 8(5) PIPEDA
• Whether the telecommunications firm provided access to personal information as required by Principle 4.9 PIPEDA
• Whether the telecommunications firm responded to the access request within a reasonable time and at minimal or no cost under Principle 4.9.4 PIPEDA
• Whether the telecommunications firm retained personal information that was the subject of an access request for as long as necessary to allow the individual to exhaust any recourse under subsection 8(8) PIPEDA
• Whether the telecommunications firm implemented policies and practices to give effect to the principles, including training staff and communicating policies and practices under Principle 4.1.4(c) PIPEDA