Canadian privacy & access decisions

A member of a not-for-profit association complained that the association required a second piece of identification, in addition to his membership card, to obtain member discounts. The complainant believed his membership card should be sufficient and that collecting further personal information was unwarranted. The association explained that it had legal agreements with vendors requiring it to sell discounted products only to current members. Due to some members loaning their cards to non-members, which caused legal and revenue issues, the association implemented the supplementary identification requirement to confirm identity and prevent misuse. The association also noted that members could choose their secondary identification and that this information was not recorded. The complainant was satisfied with this explanation, and the complaint was settled.

• Whether requiring supplementary identification for member discounts was an unwarranted collection of personal information
• Whether the membership card alone was sufficient identification

An individual complained about a retail chain's practice of printing personal information on receipts and collecting excessive information for returns. The complainant was concerned that the printing of name, credit card number, and expiry date on receipts, and the recording of driver's license and credit card information for refunds, constituted unnecessary collection of personal information. During the investigation, the company updated its point-of-sale equipment to mask personal information on receipts. For returns, the company committed to continuing to collect name, address, and telephone number, but would no longer record identification information, only asking to see it. Credit card information would only be requested if a credit card was used for the original purchase. The company also committed to training its employees on these new procedures. Both the complainant and the OPC were satisfied with these changes.

• Whether printing customer's name, credit card number, and expiry date on receipts constituted unnecessary collection of personal information under PIPEDA
• Whether requiring and recording a driver's license and credit card for returns constituted unnecessary collection of personal information under PIPEDA

An individual complained that a bank employee improperly disclosed her bank account balance to her estranged husband. The husband subsequently withheld a support payment, causing financial difficulty for the complainant. The bank apologized and acknowledged that its employee likely contravened Principle 4.3 of PIPEDA by disclosing personal information without consent. Although the employee denied the specific recollection, the bank found no evidence to suggest the allegations were false. The bank and the complainant reached a private settlement regarding compensation. The OPC concluded that there was no systemic problem, as the bank had adequate privacy policies and training in place.

• Whether a bank employee disclosed personal information without consent
• Whether the disclosure of a bank account balance to an estranged spouse contravened Principle 4.3 of PIPEDA

An individual complained that a retail store inappropriately collected her personal information and disclosed it to a financial institution, and that the financial institution used and disclosed her information without consent. The complainant provided her information for a credit application but decided not to proceed, tearing up the contract. However, due to a salesperson's error, her information was entered into the system before her signature, leading to a credit card being issued. The financial institution apologized, removed inquiries from her credit file, and purged her information. The retail store implemented new procedures to ensure signatures are obtained before data entry. Both the complainant and the OPC were satisfied with the corrective actions.

• Whether the retail store inappropriately collected and disclosed personal information without consent
• Whether the financial institution used and disclosed personal information without consent
• Whether the salesperson followed proper procedure for credit applications

An individual complained that a company sent him an unsolicited commercial e-mail promoting its products. The company, which typically markets through a distributor network and commission sales agents, was unaware that one of its agents was using email for marketing. The company does not approve of this marketing technique. Upon learning of the issue, the company contacted the agent and instructed them to cease using email for marketing. The agent confirmed compliance and apologized to the complainant. The company, despite its small size, has a privacy policy and a designated privacy officer. The complainant was satisfied with the resolution.

• Whether sending unsolicited commercial email constitutes a contravention of PIPEDA

An individual complained that a department store disclosed his personal information to a third party, a credit monitoring service, after he had requested that his information not be shared. The complainant received a mail solicitation that appeared to be supported by the department store but sent by the third party. The investigation found that the department store had not disclosed the complainant's personal information; rather, the store conducted the mail-out on behalf of the third party. The store acknowledged that the mail-out should have been clearer about its role and apologized. The store also agreed to review its account application policies to allow new customers to opt out at enrolment and to improve its suppression mechanisms. The complaint was settled during the investigation.

• Whether the department store disclosed personal information to a third party without consent
• Whether the mail-out clearly indicated the department store's role
• Whether the department store's opt-out mechanisms were adequate

An individual complained to the OPC after a collection agency failed to correct inaccurate information in his credit file, despite his lawyer's repeated attempts. The complainant had paid off a debt years prior, but the collection agency had not reported this to credit bureaux, causing him difficulty in securing credit. The collection agency initially had no record of the lawyer's correspondence. However, after the OPC intervened and the lawyer sent another letter, the agency investigated and confirmed the debt was paid. Consequently, the agency updated the credit bureaux, and the complainant's credit files were amended. The complaint was settled during the investigation.

• Whether the collection agency failed to ensure the accuracy of personal information it held
• Whether the collection agency failed to correct inaccurate personal information upon request

Several employees of a federally regulated transportation company complained that a list of employees receiving severance packages, including names, identification and seniority numbers, and Social Insurance Numbers (SINs), was disclosed to their union without their knowledge or consent. The company admitted that the SINs were included on an electronic spreadsheet provided to the union, though in a hidden column. The employer did not obtain employee consent for this disclosure. During the investigation, the company changed its severance application process to no longer require SINs. The company also agreed to amend its application form to include a consent statement for the release of personal information to the union. The complaint was settled during the investigation.

• Whether the disclosure of employee names, identification numbers, seniority numbers, and Social Insurance Numbers to a union without consent contravened PIPEDA

An individual complained that a bank inappropriately required a credit check and other personal information, including length of employment and Social Insurance Number (SIN), to open a no-fee personal deposit account online. The complainant also found the language regarding information exchange with credit bureaus unclear. The bank agreed to modify its online application forms to clarify that credit checks are optional for deposit accounts if applied for in person. It also agreed to only request length of employment for credit applications and make SIN provision optional. The bank committed to reviewing the language concerning credit bureau information exchange. The OPC confirmed the complainant's credit rating was unaffected. Both the complainant and the OPC were satisfied with the bank's actions.

• Whether a credit check was appropriately required for a no-fee personal deposit account
• Whether length of employment was appropriately required for a no-fee personal deposit account
• Whether the Social Insurance Number (SIN) was appropriately required for a no-fee personal deposit account
• Whether the language describing information exchange with credit bureaus was clear

An individual complained that a pharmacy chain required him to sign an overly broad consent form for medication, fearing his personal information would be used for marketing. The complainant was concerned he would be denied medication if he refused consent. The OPC clarified with the pharmacy that it did not disclose personal information for secondary marketing purposes. The pharmacy, having received similar complaints, revised its consent form to be simpler and clearer. It also introduced a new policy allowing customers to verbally consent to privacy practices if they were uncomfortable signing the form. The complainant was satisfied with these changes.

• Whether the pharmacy's consent form authorized overly broad disclosure practices
• Whether personal information was being disclosed for marketing purposes
• Whether the pharmacy's consent process was appropriate under PIPEDA

The OPC received two separate complaints against two different banks concerning the improper disclosure of personal information through envelope windows. In the first case, a complainant received RRSP transfer documents where Social Insurance Numbers (SINs) were visible through the envelope window. The bank acknowledged the issue and implemented a new process to ensure SINs and account numbers are not visible. In the second case, a complainant received a dormant account notice where the word "Bankrupt" and a date were visible through the envelope window below his name. The bank modified its process for client profile notations to prevent such information from appearing in the address field. Both complaints were settled during the course of the investigations, with the banks taking satisfactory corrective actions.

• Whether Social Insurance Numbers visible through an envelope window constituted inadequate protection of personal information under PIPEDA
• Whether a bankruptcy notation visible through an envelope window constituted improper disclosure of personal information under PIPEDA
• Whether the banks' practices for handling and displaying personal information on mailings met PIPEDA's protection requirements

An individual complained that his former employer, an interprovincial trucking company, disclosed his personal information to a creditor without his consent. The investigation found no evidence to support this allegation; in fact, the complainant had provided some of the information to the creditor himself. During the investigation, the trucking company, a small family-owned business, developed and implemented a written privacy policy, appointed an Information Officer, and reviewed its practices regarding employee information. The company also took steps to ensure its employees were aware of fair information handling practices. Both the complainant and the OPC were satisfied with these actions, and the matter was settled.

• Whether the trucking company disclosed the complainant's personal information to a creditor without consent

An individual complained that an insurance company required overly broad consent for the collection, use, and disclosure of personal information when applying for life insurance. The OPC found the company's actual practices were compliant with PIPEDA. However, the company acknowledged the complainant's concerns about the clarity and precision of its consent language. The company agreed to revise its consent forms and share the updated language with the complainant for feedback. The complainant was satisfied with the company's explanation and its commitment to review the consent language. The complaint was settled during the investigation.

• Whether the insurance company's consent language was overly broad
• Whether the insurance company's collection, use, and disclosure practices were consistent with PIPEDA

A complainant's laptop, returned for repair, was sold by a retail store with her personal information still on it. The individual who purchased the laptop contacted the complainant, raising concerns about the store's safeguards. The investigation revealed an employee sold the returned laptop without wiping its data. The company retrieved the laptop and returned it to the complainant. In response, the store implemented new procedures to ensure all customer data is wiped from returned electronic devices, with documentation required for these actions. The complainant was satisfied with these changes, and the complaint was settled.

• Whether the retail store adequately safeguarded the complainant's personal information on a returned laptop
• Whether the retail store's practices led to an unauthorized disclosure of personal information

A former employee complained that his previous employer, a trucking company, disclosed his personal information to other trucking firms after his employment ended. While the original complaint focused on the disclosure, the Office of the Privacy Commissioner (OPC) also identified the absence of a company privacy policy and a designated privacy representative as issues. Through discussions, both parties reached a settlement. The trucking company agreed to develop privacy policies and procedures, which it subsequently provided to the OPC, and also appointed a privacy officer. The complaint was settled during the investigation.

• Whether a trucking company disclosed personal information about a former employee to other firms without authorization
• Whether the trucking company had adequate privacy policies and procedures in place
• Whether the trucking company had a designated privacy officer