Canadian Privacy Decisions

This report details an investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants. The investigation found that both Employment and Social Development Canada (ESDC) and Justice Canada failed to adequately translate their privacy and security policies into practice, leading to weaknesses in physical, technological, administrative, and personnel controls. Both departments accepted nine recommendations to improve data protection, many of which were similar to those made in a previous investigation involving ESDC.

• Adequacy of physical, technological, administrative, and personnel security controls
• Failure to translate privacy and security policies into meaningful business practices
• Protection of sensitive personal information including SIN and medical details
• Custody and storage of portable electronic devices containing personal information

An individual complained that a videographer hired to record her wedding shared her personal information without consent by posting the wedding video online for business promotion. The OPC found that using the video for promotional purposes was a commercial activity requiring consent, which the videographer had not obtained. Although the videographer initially disputed this, they eventually removed the video and agreed to include consent provisions in future contracts, leading to the complaint being resolved.

• Was the use of the wedding video for promotional purposes considered a commercial activity under PIPEDA?
• Did the videographer obtain the complainant's informed consent for the use of her personal information?
• Did any exemptions under PIPEDA apply to the videographer's use of the video without consent?