Canadian privacy & access decisions

An individual complained after an insurance company refused to provide access to her personal information following an incident at a store. The individual sought access to her insurance claim file, including case management notes and a video of the incident. The company initially refused, citing confidential commercial information and the personal information of third parties. Through the OPC's early resolution process, the company agreed to allow the individual to view the video and provided a redacted copy of the case management notes. The OPC's Early Resolution Officer reviewed the redactions to ensure they were properly applied. The complaint was resolved to the satisfaction of both parties.

• Whether an organization must provide an individual with access to their personal information upon request
• Whether case management notes constitute "confidential commercial information" under PIPEDA paragraph 9(3)(b)
• Whether a video containing images of third parties can be withheld from an access request
• Whether an organization can fulfill its access obligations by allowing viewing of a record rather than providing a copy
• Whether redaction of confidential commercial information or third-party personal information is an appropriate method to grant access

A complainant sought to open an online financial investment account with a FinTech organization. To access the investment account management agreement, the complainant was required to provide personal information, some of which was sensitive. After reviewing the agreement, the complainant decided not to open an account and requested deletion of their personal information. The organization cited "regulatory requirements" for the collection. The OPC clarified that while regulatory requirements exist, they apply once an individual becomes a client, not before. The OPC advised the organization to revise its website so prospective clients could review the agreement without prior personal information disclosure. The organization agreed to revise its website and Privacy Policy, leading to an early resolution.

• Whether a FinTech organization can require personal information before a prospective client reviews terms and conditions
• Whether consent under PIPEDA is meaningful if personal information is collected before a user can review service agreements
• Whether regulatory requirements justify collecting personal information from prospective clients who do not proceed with opening an account

An individual complained that a bank performed numerous credit checks on her without consent, despite her not being a client for many years. The bank initially claimed the inquiries were from its marketing group and not visible to other organizations, but its internal investigation revealed they were 'soft hits' related to inactive accounts from 2013. The bank's privacy policy stated it retained the ability to perform credit inquiries after a service ended, but the OPC expressed concern over the continued collection of sensitive credit information without a legal requirement. To resolve the complaint, the bank agreed to cease this practice and update its privacy policy. The complainant was satisfied, and the matter was early resolved.

• Whether a bank can continue to perform credit checks on former clients without their consent
• Whether the bank's privacy policy adequately justified continued credit inquiries after the termination of a business relationship
• Whether the bank provided accurate information to the complainant regarding the source and nature of the credit inquiries