Canadian Privacy Decisions

The complainant alleged that the RCMP inappropriately used employees' personal information during a training course. The RCMP used real personal information from 91 employees for a data entry exercise without their consent and without advising participants of the data's sensitive nature. The RCMP acknowledged the contravention of section 7 of the Privacy Act and notified the affected employees.

• Use of personal information for training purposes without consent
• Adequacy of notification to affected individuals
• Consistency of use with the original purpose of collection

The complainant alleged that the Parole Board of Canada (PBC) contravened the Privacy Act by disclosing her medical information to external parties involved in a Public Service Staffing Tribunal (PSST) hearing. The PBC acknowledged that a human resources employee inadvertently emailed documents containing the complainant's medical information, which was outside the scope of the PSST's order. The PBC apologized to the complainant, ensured the recipients disposed of the information, and reported the breach internally.

• Was the complainant's medical information disclosed without consent or lawful authority?
• Did the disclosure contravene the Privacy Act's provisions on disclosure of personal information?
• Were the corrective actions taken by the PBC satisfactory?

The OPC discontinued further complaints against Globe24h.com concerning the collection, use, and disclosure of personal information from Canadian court and tribunal decisions. While initial complaints were found to be well-founded, additional complaints were discontinued as the issues had already been investigated and reported on. The matter was further resolved when the Federal Court ordered Globe24h to remove personal information from its website and the website subsequently ceased operations.

• Collection, use, and disclosure of personal information from public court decisions
• Consent for republishing personal information
• Discontinuance of investigation based on prior report
• Circumvention of privacy laws by republishing sensitive data

The complainant alleged that the Canada Border Services Agency (CBSA) improperly disclosed his personal information to his country of origin without consent. The CBSA disclosed a court judgment related to the complainant's criminal history to the High Commission of Canada to Ghana, which then forwarded it to Interpol for verification. The OPC found that while the disclosure was for a consistent purpose under the Privacy Act (enforcing immigration law), the CBSA's procedures for such disclosures were insufficient at the time, and the electronic transmission of information raised concerns.

• Disclosure of personal information to a foreign entity for verification purposes.
• Whether the disclosure constituted a consistent use of information under the Privacy Act.
• Adequacy of CBSA procedures for international disclosure and verification requests.
• Concerns regarding the electronic transmission of personal information.

The complainant alleged that Public Services and Procurement Canada (PWGSC) contravened the Privacy Act when a Director disclosed that the complainant had filed a harassment complaint against her during a management meeting. The investigation confirmed the disclosure, and found that the Director had not obtained the complainant's consent and that the attendees did not need to know the information. As a result, the complaint was found to be well-founded.

• Definition of personal information under section 3 of the Privacy Act
• Rules regarding the disclosure of personal information under section 8 of the Privacy Act
• Application of Treasury Board and departmental policies on confidentiality of harassment complaints

This investigation concerned a complaint against Health Canada (HC) regarding the mailing of 41,514 letters using windowed envelopes that revealed the name of the "Marihuana Medical Access Program" (MMAP). The Office of the Privacy Commissioner of Canada (OPC) found that HC contravened the Privacy Act by disclosing sensitive personal information without consent or legitimate purpose. Although HC cited administrative error and argued implicit consent or consistent use, the OPC determined that the sensitive nature of the program name required greater protection. HC has since implemented stricter mail-out procedures and created a new working group.

• Whether the visible program name in the return address constituted a disclosure of personal information.
• Whether implied consent was obtained from recipients.
• Whether the disclosure was a 'consistent use' of information under section 8(2)(a) of the Privacy Act.
• Whether Health Canada took reasonable steps to protect sensitive personal information.

The complainant, a former Canadian Forces member, alleged that the Department of National Defence (DND) contravened the Privacy Act by prematurely destroying an audio recording of his Progress Review Board (PRB) hearing. The OPC found that the recording contained personal information used for an administrative purpose and should have been retained for at least two years, as required by the Act, unless the complainant consented to its destruction. DND's destruction of the recording shortly after the hearing was deemed premature. The OPC recommended that DND develop a policy for retention and disposal of PRB hearing records and, in the interim, retain such recordings or transcriptions for at least two years.

• Whether the audio recording of the PRB hearing contained personal information used for an administrative purpose.
• Whether the complainant consented to the destruction of the audio recording.
• Whether DND's destruction of the audio recording violated the retention provisions of the Privacy Act.
• Whether DND provided access to accurate records following the hearing.