Canadian privacy & access decisions

A financial management firm's employees breached internal security procedures by sending a client's detailed financial plan and federal income tax notice of assessment, containing sensitive personal information including her social insurance number, to her personal email account without secure messaging tools. The client's email account was subsequently hacked, and the alleged hacker used the obtained information to pose as the client and request a significant transfer from her investment account. An employee processed this transfer without following authentication procedures. Although the client's money was not stolen, the firm investigated the incident, advised the client to change passwords, informed the RCMP, and offered credit monitoring. The firm also took measures with the responsible employees, provided additional privacy training to staff, and reviewed its internal processes. The OPC considered the firm's response appropriate.

• Whether the firm adequately protected personal information by sending sensitive documents via unsecure email
• Whether the firm had adequate procedures for authenticating clients for financial transactions
• Whether the firm's response to the privacy breach was appropriate

An individual received their RRSP tax contribution statement from a financial institution, but one copy contained the personal information of another individual, including their name, address, account number, RRSP contribution, and social insurance number. The financial institution reported the mass-mailing error to the OPC, explaining that a production error during automated printing caused a few hundred incorrect statements to be mailed. The OPC noted that the financial institution reacted quickly by assembling a breach response team, notifying affected clients, providing new statements, increasing account monitoring, and offering complimentary credit alert monitoring. The institution also asked clients to destroy incorrect statements and implemented new internal controls to prevent future errors. The OPC highlighted the importance of precautions in mass mail-outs and having systems to respond to errors.

• Whether the financial institution adequately safeguarded personal information during mass mail-outs
• Whether the financial institution responded appropriately to a privacy breach involving misdirected mail

A Canadian financial institution reported a privacy breach where a fraudster used deceptive impersonation techniques to obtain contact information for approximately 100 customers from its customer service centre employees. The fraudster then contacted these customers directly to extract additional sensitive personal information, potentially exposing them to identity theft. Upon discovering the incident, the financial institution alerted the OPC, conducted an investigation, and notified all affected customers, offering them complimentary credit protection monitoring. The institution also advised customers on how to prevent fraud and implemented enhanced controls and additional staff training to mitigate recurrence. No reports of fraud related to credit or debit cards were received by the institution as a result of the incident.

• Whether the financial institution adequately protected customer personal information from unauthorized disclosure by a fraudster
• Whether the financial institution took appropriate steps to mitigate the impact of the breach and prevent recurrence

The OPC was alerted to a cable provider posting a list of customers with overdue accounts and the amounts owed on a municipal Facebook page. The cable provider believed this practice was permissible, citing municipal tax arrears publications as an example. The OPC informed the provider that publicly disseminating personal information for debt collection without consent is not permitted under PIPEDA, even though disclosure to a third-party debt collector may be. The cable provider subsequently removed the posting. The OPC also clarified with the NWT Commissioner that municipal tax arrears publications are mandated by territorial law, unlike the cable provider's actions. The OPC explained that PIPEDA's debt collection exemption does not authorize public disclosure.

• Whether publicly posting customer debt information on social media is permissible under PIPEDA
• Whether the debt collection exemption under paragraph 7(3)(b) of PIPEDA authorizes public dissemination of personal information
• Whether municipal practices of publishing tax arrears are comparable to private organizations publishing customer debt under PIPEDA