Canadian Privacy Decisions

Biron Health Group sent promotional emails to travellers who had undergone COVID-19 testing upon arrival in Canada, using their email addresses collected for testing purposes. The complainant alleged this violated PIPEDA. Biron argued they assumed implicit consent due to a business relationship, but the OPC found this assumption unreasonable given the mandatory nature of the testing. Biron has since ceased the practice, deleted affected email addresses, and the complaint was settled.

• Use of personal information for secondary marketing purposes without consent
• Reasonableness of assuming implicit consent in a mandatory service context
• Nature of consent required for collecting and using health-related information

Parents complained they could not access their 17-year-old daughter's online dental benefit information, even though they paid for her plan and expenses. The plan administrator's policy required consent from individuals aged 16 or older before their information could be disclosed to other plan members. The parents were satisfied with the administrator's explanation of its policy, which was based in part on Ontario's Health Care Consent Act.

• Disclosure of dependent's personal information to parents
• Requirement for consent from mature minors
• Application of PIPEDA's consent requirements