Canadian Privacy Decisions

A complaint was filed against the Canada Border Services Agency (CBSA) alleging that its use of video surveillance to monitor employees at a border crossing contravened the Privacy Act. The complainant argued that the CBSA was using video technology to collect personal information for monitoring employee conduct and performance, beyond the initial safety and security purposes, and that signage was insufficient. While the CBSA's signage issue was resolved, the investigation focused on the collection of employee information for monitoring. The OPC found that the CBSA's updated policies and rationale for collecting personal information for integrity and quality assurance, including investigating serious misconduct, met the Act's requirements, but awaited confirmation of updated guidelines.

• Use of video surveillance for monitoring employee conduct and performance
• Necessity and proportionality of collecting personal information via video surveillance
• Sufficiency of signage informing employees of video monitoring
• Compliance with the Privacy Act's requirement that personal information collection relates directly to an operating program or activity

A life insurance company discovered a potential breach of personal information when a new envelope design exposed sensitive data, including SINs, of 53 pension plan members. The company took prompt action by notifying affected individuals, offering credit monitoring services, and implementing new security measures to prevent recurrence. The OPC noted the company's response demonstrated best practices in handling such incidents.

• Potential exposure of sensitive personal information (SIN, date of birth, beneficiary information) due to envelope design.
• Adequacy of the company's response to the potential breach.
• Measures taken to prevent future incidents.

An individual complained that her bank required her to provide the last six digits of her Social Insurance Number (SIN) to set up a verified credit account for online purchases. The complainant believed this collection was unnecessary and sought an alternative. The bank initially maintained its practice but, after being informed of a similar OPC finding regarding transparency, discontinued the practice and updated its website to remove this authentication method. The complaint was resolved.

• Bank's collection of partial SIN for account verification
• Transparency of alternative authentication methods
• Adequacy of information provided on the bank's website