Canadian privacy & access decisions

This document is a compliance letter from Nova Scotia Power to the OPC, outlining actions taken and commitments made following a significant data breach that occurred in March 2025. The breach, caused by malware, led to the exfiltration of personal information belonging to approximately 375,000 current and 540,000 former customers. The compromised data included names, contact information, financial details, driver's license numbers, and SINs. The OPC received numerous complaints regarding the breach, including concerns about the collection and retention of SINs and the timeliness and method of notification to affected individuals. Nova Scotia Power has committed to deleting customer SINs (subject to legal requirements) and undergoing an external security assessment by October 2026. Upon satisfactory fulfillment of these commitments, the OPC's investigation will be discontinued.

• Whether Nova Scotia Power's security safeguards were adequate to protect personal information
• Whether Nova Scotia Power's collection and retention of Social Insurance Numbers (SINs) was appropriate
• Whether Nova Scotia Power's notification of affected individuals was timely and appropriate
• Whether Nova Scotia Power has taken sufficient corrective measures to address the breach and prevent future incidents

The World Anti-Doping Agency (WADA) entered into a compliance agreement with the Privacy Commissioner of Canada (OPC) to resolve an investigation into WADA's collection, use, and disclosure practices concerning athletes' personal information in its Anti-Doping Administration and Management System (ADAMS). The OPC launched an investigation after receiving a complaint, and WADA disputed the allegations and challenged the OPC's jurisdiction in Federal Court. Without admitting contravention or waiving jurisdictional rights, WADA agreed to remedial measures. These measures include ceasing to permit Anti-Doping Organizations (ADOs) to use ADAMS data for non-anti-doping purposes, updating the World Anti-Doping Code, and amending agreements with ADOs to restrict data use to anti-doping purposes only. WADA will also provide the OPC with a mechanism to ensure ADOs adhere to these restrictions. The investigation will be placed in abeyance and discontinued upon completion of the remedial measures.

• Whether WADA's collection, use, and disclosure practices of athletes' personal information in ADAMS comply with PIPEDA
• Whether the OPC has statutory, territorial, and/or subject matter jurisdiction over WADA
• Whether ADOs are permitted to use personal information in ADAMS for purposes other than anti-doping

An individual complained that a real estate management company collected his personal information without consent through surveillance cameras. He alleged inadequate signage and over-collection when a camera was focused on him after a dispute about his service dog. The company responded by posting new, clearer signage about video surveillance at all entrances, including the one previously lacking. They also addressed the over-collection concern by explaining that a new security guard had mistakenly focused the camera, and provided additional training to staff regarding service animals. The OPC found the company's response to be fair and reasonable, addressing the complainant's concerns proactively. Consequently, the investigation was discontinued.

• Whether the organization collected personal information without adequate signage for video surveillance
• Whether the organization over-collected personal information by focusing a camera on the complainant
• Whether the organization's response to the concerns was fair and reasonable under paragraph 12.2(1)(c) of PIPEDA

An individual filed a complaint against a retailer, alleging a failure to provide access to personal information under PIPEDA. This complaint arose after the complainant and the retailer had settled a small claims court dispute. As part of that settlement, the complainant had signed a mutual release, receiving financial compensation in exchange for releasing the retailer from all claims and complaints, including those arising under statute, related to events prior to the release date. The OPC found that the complaint was made in bad faith, given the existence of this mutual release. Consequently, the investigation was discontinued under paragraph 12.2(1)(b) of PIPEDA.

• Whether the complaint was made in bad faith under paragraph 12.2(1)(b) of PIPEDA
• Whether a mutual release agreement impacts the validity of a subsequent privacy complaint

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased