Canadian privacy & access decisions

The complainant alleged that Biron Health Group (Biron) sent him promotional emails without his consent after he underwent mandatory COVID-19 testing upon arrival at Montreal Trudeau Airport. He provided his email solely for test results. Biron initially believed it had implicit consent due to an established business relationship. The OPC found that Biron could not reasonably assume implicit consent, as travellers had no choice but to use Biron for mandatory testing and would not expect their health information to be used for marketing. Biron ceased the practice and deleted affected email addresses from its marketing database. The complaint was settled during the investigation.

• Whether Biron Health Group had implicit consent to send promotional emails to individuals undergoing mandatory COVID-19 testing
• Whether the collection of personal information for mandatory health testing could be used for secondary marketing purposes

The parents of a 17-year-old dependent complained that they could not access their daughter's online dental benefit information from their group dental plan administrator. The administrator's policy required consent from individuals aged 16 or older before their information could be accessed by another plan member, even parents. The administrator defended its policy by citing PIPEDA's consent requirements, the lack of a national age of majority consensus, and the distinction between age of majority and age of consent. The policy was based on the Ontario Health Care Consent Act, which suggests 16 as an age for health care consent. The mother was satisfied with the explanation and understood that she could access her daughter's account if her daughter provided consent by sharing her password.

• Whether a dental plan administrator requires consent from a 17-year-old dependent to disclose her dental benefit information to her parents
• Whether the age of majority or age of consent impacts the requirement for consent under PIPEDA for minors