Canadian Privacy Decisions

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without her consent. The investigation found merit to the complaint. The institution agreed to apologize to the complainant, adjust her loan, implement privacy policies and practices, establish a privacy committee, provide employee training, and remind staff to limit disclosure during debt recovery. The complainant and the OPC were satisfied with the actions taken, and the case was settled.

• Unauthorized disclosure of personal information
• Lack of privacy policies and practices
• Compliance with PIPEDA obligations

An employee of a national transportation company complained about the security of employee personal information in an automated crew management system. The complainant was concerned that unauthorized personnel, including union representatives, could access sensitive information like date of birth, SIN, and wage rates. The company agreed to modify the system to prevent the display of SIN, birth date, and health information on certain screens. As the complainant's concerns were addressed, the case was settled.

• Security of employee personal information
• Access to sensitive personal information (SIN, date of birth, health information) by unauthorized personnel
• Appropriate use and disclosure of employee data