Canadian privacy & access decisions

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against Facebook Inc. following a 2013 privacy breach where contact information, including that of non-users, was inadvertently disclosed via the 'Download Your Information' (DYI) tool. The investigation focused on Facebook's safeguards, consent practices for its 'matching across address books' process for both users and non-users, and the ability for individuals to access and correct their personal information. The OPC found Facebook's safeguards inadequate prior to the breach, but deemed the issue resolved after Facebook implemented a new Privacy Framework. While Facebook's use of user contact information for matching was found not to contravene consent principles, the OPC determined Facebook was not sufficiently open about these practices, an issue conditionally resolved by Facebook's commitment to revise its notices. The OPC also found Facebook used non-users' personal information for matching without meaningful consent, an issue resolved by Facebook's agreement to stop maintaining such data. Finally, Facebook was found not to be providing adequate access to and correction of matched data, which was resolved through an interim solution.

• Whether FB had appropriate safeguards in place prior to the breach to protect contact information of users and non-users.
• Whether FB implemented appropriate safeguards after the breach.
• Whether FB was using the personal information of users and non-users during the process of matching across address books.
• Whether FB was obtaining meaningful consent from users for the use of personal information during the matching process.
• Whether FB was meeting its obligation to be open about its policies and practices regarding the matching process for users.
• Whether FB was obtaining meaningful consent from non-users for the use of personal information during the matching process.
• Whether FB was providing users and non-users the ability to obtain access to their personal information/data.
• Whether FB was providing users and non-users the ability to correct their personal information/data.
• Whether the breach resulted in unauthorized disclosure of personal information.
• Whether the testing conducted by FB for the DYI tool was adequate.
• Whether the notice provided to non-users in email invitations was consistent with PIPEDA s.6.1 and Principles 4.3 and 4.8.
• Whether providing access to matched data would likely reveal personal information about a third party under PIPEDA s.9(1).
• Whether providing access to matched data would raise safety and security concerns.

A complainant alleged that a courier company disclosed her personal information without consent by delivering a package containing financial documents to her neighbour. The courier company's policy allowed drivers to deliver packages to neighbours if the addressee was not home, a practice the complainant was unaware of as she was not expecting the package. The OPC found that the courier company contravened Principle 4.3 of PIPEDA by failing to obtain consent for this practice, either directly from the complainant or by ensuring the shipper had obtained it. The OPC noted that the sensitivity of the package's contents and the complainant's unlisted phone number on the label heightened the need for express consent. The courier company committed to ending the 'delivery to a neighbour' practice in response to the OPC's recommendations. The OPC later confirmed the practice had ceased.

• Whether the courier company obtained valid consent for delivering a package to a neighbour
• Whether the courier company exercised due diligence to ensure the shipper obtained consent for 'delivery to a neighbour'
• Whether the information disclosed (name, address, unlisted telephone number, and package contents) was sensitive in context

The Office of the Privacy Commissioner of Canada (OPC) initiated an investigation into the World Anti-Doping Agency (WADA) following a 2016 data breach of its Anti-Doping Administration and Management System (ADAMS) by the "Fancy Bear" hacking group. The breach led to the public disclosure of highly sensitive personal and health information of 127 athletes, with 11,837 athletes' data potentially accessible. The OPC examined whether WADA had sufficient security safeguards under PIPEDA Principles 4.1.4, 4.7, 4.7.1, 4.7.2, and 4.7.3. The investigation found WADA's safeguards to be insufficient, particularly concerning access controls, monitoring, policies, and encryption, given the sensitivity of the data and the sophisticated nature of the attack. WADA agreed to implement most of the OPC's recommendations, including developing a comprehensive information security framework, strengthening access controls, and employing encryption at rest. The OPC accepted WADA's proposal for optional two-factor authentication for athletes, provided WADA actively promotes its use. Consequently, the matter was concluded as well-founded and conditionally resolved, with the OPC entering into a compliance agreement to monitor WADA's implementation.

• Whether WADA's security safeguards were appropriate to the sensitivity of the personal information in ADAMS, as required by PIPEDA Principles 4.7, 4.7.1, 4.7.2, and 4.7.3.
• Whether WADA had implemented adequate policies and practices to give effect to PIPEDA principles, including procedures for protecting personal information, staff training, and policy documentation, under Principle 4.1.4.
• Whether WADA's access controls, including password management, multi-factor authentication, and oversight of administrative accounts granted to Anti-Doping Organizations (ADOs), were sufficiently robust.
• Whether WADA's monitoring and logging capabilities were adequate to detect and respond to security anomalies and intrusions.
• Whether WADA had a proper incident response plan and a documented risk-management framework.
• Whether WADA employed encryption for data at rest in the ADAMS database.
• Whether WADA provided sufficient security awareness training to its staff and ADAMS stakeholders.

An anonymous complainant challenged an online marketplace's privacy practices after receiving an advocacy email without explicit consent. The complaint alleged unauthorized use of personal information for lobbying, inadequate handling of her privacy complaint, and unnecessary retention of data. The OPC found that the retention allegation was not well-founded. However, the OPC determined that the online marketplace failed to obtain adequate consent for sending advocacy emails and mishandled the complainant's privacy concerns, contravening PIPEDA Principles 4.3 and 4.10 respectively. The organization initially committed to corrective measures, including updating its privacy policy, providing an opt-out for advocacy messages, and improving its complaint handling process. Following the successful implementation of these recommendations, the OPC deemed the consent and challenging compliance matters well-founded and resolved.

• Whether the online marketplace obtained valid consent under PIPEDA Principle 4.3 for using email addresses to send advocacy emails.
• Whether the online marketplace adequately explained the purposes for using personal information such that the individual could reasonably understand how it would be used (PIPEDA Principle 4.3.2).
• Whether the form of consent obtained was appropriate given the reasonable expectations of the individual and the sensitivity of the information (PIPEDA Principles 4.3.4, 4.3.5, 4.3.6).
• Whether the online marketplace enabled the complainant to address concerns to the designated individual accountable for PIPEDA compliance (PIPEDA Principle 4.10).
• Whether the online marketplace implemented policies and practices to receive and respond to complaints and trained staff (PIPEDA Principles 4.1.4(b), 4.1.4(c)).
• Whether the online marketplace retained personal information longer than necessary for the identified purpose (PIPEDA Principle 4.5).

VTech Holdings Limited, a connected toy manufacturer, experienced a global data breach affecting over 316,000 Canadian children and 237,000 Canadian adults. The OPC launched an investigation after receiving a complaint from an affected Canadian. The investigation revealed significant safeguard deficiencies, including a lack of testing, inadequate access controls, cryptographic weaknesses, and no comprehensive security management program. These deficiencies were not commensurate with the sensitivity of the information, especially that of children. However, VTech implemented timely and comprehensive measures to contain the breach, mitigate risks to affected individuals, and address safeguard concerns during the investigation. The OPC concluded that the matter was well-founded and resolved due to these corrective actions.

• Whether VTech Holdings Limited failed to adequately safeguard personal information under Principle 4.7 PIPEDA
• Whether VTech's security safeguards were appropriate to the sensitivity of the information (Principle 4.7 PIPEDA)
• Whether VTech's safeguards protected against unauthorized access, disclosure, copying, use, or modification (Principle 4.7.1 PIPEDA)
• Whether the nature of VTech's safeguards varied depending on the sensitivity, amount, distribution, format, and storage method of the information (Principle 4.7.2 PIPEDA)
• Whether VTech's methods of protection included physical, organizational, and technological measures (Principle 4.7.3 PIPEDA)
• Whether VTech had adequate testing and maintenance protocols to identify and mitigate vulnerabilities
• Whether VTech had adequate administrative access controls
• Whether VTech had adequate cryptographic protection for personal information
• Whether VTech had sufficient security monitoring and logging to detect threats
• Whether VTech had a comprehensive security management program

A complainant objected to a retail store retaining records of her credit card transactions and refusing to delete them upon request. The store initially cited contractual obligations with credit card companies. During the OPC's investigation, the retail company provided a more detailed explanation, including its legal obligations under the Excise Tax Act to retain transactional data. The OPC relayed this information to the complainant, who was satisfied with the explanation and considered the matter resolved. The complainant noted that if this information had been provided initially, she would not have filed a complaint.

• Whether a retail store's retention of credit card transaction records without deletion upon request violated PIPEDA's consent principle
• Whether legal or contractual obligations justified the retention of personal information despite a withdrawal of consent

A complainant alleged that a financial institution required customers to provide their Social Insurance Number (SIN) to credit reporting agencies for identity verification when opening a savings account, even though the SIN was not needed for income reporting. The financial institution argued that using the SIN for identity verification was beneficial for maintaining data integrity and cited FINTRAC guidelines. The OPC reviewed FINTRAC and Employment and Social Development Canada (ESDC) guidelines and found no requirement or suggestion for using SINs for identity verification. The OPC concluded that requiring consent for this practice as a condition of service contravened Principle 4.3.3 of PIPEDA. The financial institution agreed to make the use of SIN for identity verification optional, and the complaint was deemed well-founded and conditionally resolved. A follow-up confirmed full compliance.

• Whether requiring a SIN for identity verification as a condition of service contravenes Principle 4.3.3 of PIPEDA
• Whether FINTRAC or ESDC guidelines require or suggest the use of SINs for identity verification

A traveler complained that an airline failed to provide complete access to his personal information, specifically documents and correspondence related to being denied boarding in 2015. The airline invoked exemptions under PIPEDA, arguing the information was collected to investigate a breach of agreement or contravention of law (s.7(1)(b)) and disclosed to a government institution for law enforcement purposes (s.7(3)(c.1)(ii)). The OPC found that the collection without consent was justified under s.7(1)(b) because it was for investigating potential non-compliance with the Immigration and Refugee Protection Act, and that requiring consent would have compromised the investigation. The OPC also found the disclosure to a government institution was permissible under s.7(3)(c.1)(ii). Furthermore, the OPC determined that the airline was prohibited from providing access to the requested information under s.9(2.4) because the government institution objected to its release. Therefore, the OPC concluded that the airline properly relied on the exemptions.

• Whether the airline's collection of personal information without consent was justified under paragraph 7(1)(b) of PIPEDA
• Whether the airline's disclosure of personal information without consent was justified under subparagraph 7(3)(c.1)(ii) of PIPEDA
• Whether the airline was required to provide access to the requested personal information under Principle 4.9 of Schedule 1, given the exemptions under section 9 of PIPEDA

A complainant alleged that his financial institution improperly disclosed his personal information, specifically RESP account details from 1999, to a municipal police service. The financial institution claimed the disclosure was made under a production order or, alternatively, with the complainant's consent via its privacy policy. The OPC found that the disclosed 1999 RESP information fell outside the scope of the production order, which specified a different date range and nature of information. The OPC also rejected the financial institution's argument of consent, stating that the privacy policy's general language was insufficient for informed consent, especially for sensitive financial information. The financial institution agreed to review its procedures and provide training to ensure compliance with production orders. The complaint was found to be well-founded and resolved.

• Whether the disclosure of RESP account information from 1999 was justified under paragraph 7(3)(c) of PIPEDA as being required by a production order
• Whether the financial institution could rely on the complainant's consent, as stipulated in its privacy policy, for the disclosure of personal information to law enforcement
• Whether the RESP account information constituted sensitive personal information

A complainant alleged that a company selling "home history reports" collected, used, and disclosed personal information without consent, specifically sales history, drug activity, and insurance claims. The OPC found that sales history was no longer included in reports and insurance claims information, as clarified by the respondent, related to property damage paid to third parties, not individuals, thus not constituting personal information. However, information about drug activity was deemed personal information because it could be linked to identifiable individuals and suggested their involvement in drug activity. The OPC concluded that this drug activity information was not "publicly available" under PIPEDA Regulations, requiring consent for its use. The respondent agreed to cease including drug activity details in its reports, leading to a well-founded and resolved outcome.

• Whether sales history information constituted personal information and was collected, used, or disclosed without consent
• Whether insurance claims information constituted personal information
• Whether drug activity information constituted personal information
• Whether drug activity information was "publicly available" under the Regulations Specifying Publicly Available Information
• Whether the respondent obtained adequate consent for the collection, use, and disclosure of personal information

The Office of the Privacy Commissioner of Canada (OPC) initiated a complaint against Wajam Internet Technologies Inc., an adware developer, regarding its software's installation, consent, uninstallation, and data handling practices. The software, Wajam or Social2Search, tracked online search queries, overlaid social media results, and displayed contextual ads. The OPC investigated whether Wajam obtained meaningful consent for installation, allowed users to withdraw consent, and adequately safeguarded personal information. The investigation found that Wajam lacked a privacy accountability framework, failed to obtain meaningful consent due to problematic third-party distribution methods and misleading information, indefinitely retained unencrypted raw user data, and had insufficient safeguards. All examined matters related to accountability, consent, limiting retention, safeguards, and openness were found to be well-founded. Wajam, having sold its assets to a Hong Kong-based company, IMTL, claimed it was unable to implement the OPC's recommendations, though it agreed to securely destroy Canadian user data. The OPC requested Wajam provide the report to IMTL and stated it would monitor the situation and engage international counterparts.

• Whether Wajam Internet Technologies Inc. had an adequate privacy accountability framework in place (Principle 4.1.4 PIPEDA)
• Whether Wajam obtained meaningful consent from individuals for the installation and operation of its software (Principle 4.3, 4.3.2, 4.3.5 PIPEDA, s.6.1 PIPEDA)
• Whether Wajam's third-party distribution model ensured meaningful consent for software installation
• Whether Wajam's multiple-offer consent screens provided sufficient information for meaningful consent
• Whether the information provided by Wajam about its software's functionality and privacy practices was accurate and complete (Principle 4.2, 4.3.2, 4.3.5 PIPEDA)
• Whether Wajam permitted users to withdraw consent by making it difficult to uninstall its software (Principle 4.3.8 PIPEDA)
• Whether Wajam was responsible for unsolicited ads and fake offers presented during the uninstallation process (Principle 4.3 PIPEDA)
• Whether Wajam limited the retention of personal information to only as long as necessary for identified purposes (Principle 4.5, 4.5.2 PIPEDA)
• Whether Wajam was open about its policies and practices relating to the management of personal information (Principle 4.8 PIPEDA)
• Whether Wajam adequately safeguarded users' personal information against loss, theft, or unauthorized access, including during transmission and storage (Principle 4.7.1, 4.7.2, 4.7.3 PIPEDA)

An individual complained after an insurance company refused to provide access to her personal information following an incident at a store. The individual sought access to her insurance claim file, including case management notes and a video of the incident. The company initially refused, citing confidential commercial information and the personal information of third parties. Through the OPC's early resolution process, the company agreed to allow the individual to view the video and provided a redacted copy of the case management notes. The OPC's Early Resolution Officer reviewed the redactions to ensure they were properly applied. The complaint was resolved to the satisfaction of both parties.

• Whether an organization must provide an individual with access to their personal information upon request
• Whether case management notes constitute "confidential commercial information" under PIPEDA paragraph 9(3)(b)
• Whether a video containing images of third parties can be withheld from an access request
• Whether an organization can fulfill its access obligations by allowing viewing of a record rather than providing a copy
• Whether redaction of confidential commercial information or third-party personal information is an appropriate method to grant access

The complainant alleged that Jet Airways failed to provide complete access to her personal information related to an incident where she and her companion were removed from a flight. Jet Airways initially failed to respond to the access request within the 30-day timeframe, citing potential litigation and staff medical leave. While Jet Airways eventually provided the Passenger Name Record, it withheld other documents, claiming solicitor-client privilege (including litigation privilege) and that the information was generated during a formal dispute resolution process. The OPC found that Jet Airways contravened its obligations regarding timely response and proper policies for handling access requests and applying exemptions. However, due to binding court decisions, the OPC could not make a finding on the specific application of solicitor-client/litigation privilege to the withheld documents, leading to an impasse on that issue. The OPC recommended that Jet Airways implement proper access request procedures and review its policies for applying exemptions.

• Whether Jet Airways responded to the access request within the prescribed 30-day time period under subsection 8(3) of PIPEDA
• Whether Jet Airways had appropriate policies and practices to give effect to Principle 4.1.4 of Schedule 1 of PIPEDA
• Whether the withheld information was protected by solicitor-client privilege or litigation privilege under paragraph 9(3)(a) of PIPEDA
• Whether the withheld information was generated in the course of a formal dispute resolution process under paragraph 9(3)(d) of PIPEDA

The Office of the Privacy Commissioner of Canada (OPC) investigated complaints against Public Executions Inc., operator of publicexecutions.ca, a website that published personal information of judgment debtors for a fee. Complainants alleged their privacy rights under PIPEDA were breached by the website's practice of "naming and shaming" them into paying debts. The website owner argued PIPEDA did not apply, claiming it was not a commercial activity, was exempt as journalism, and that disclosures were permitted for debt collection. The OPC found that the website's fee-based service constituted a commercial activity under PIPEDA. It rejected the journalistic exemption, noting the lack of original production and journalistic discipline. The OPC concluded that broadly publicizing debtor information for financial gain and coercion was not an appropriate purpose under subsection 5(3) of PIPEDA, especially given existing legal mechanisms and regulations for debt collection. Furthermore, the OPC clarified that paragraph 7(3)(b) of PIPEDA, which allows disclosure for debt collection, does not permit indiscriminate disclosure to the public. Initially, the complaint was found well-founded and unresolved, as the website owner refused to comply with recommendations. However, after the OPC initiated Federal Court proceedings, the website was taken down, leading the OPC to discontinue its application.

• Whether the website's activities constituted "commercial activity" under paragraph 4(1)(a) of PIPEDA.
• Whether the website qualified for the "journalistic purposes" exemption under paragraph 4(2)(c) of PIPEDA.
• Whether the collection, use, and disclosure of personal information by the website was for purposes that a reasonable person would consider "appropriate in the circumstances" under subsection 5(3) of PIPEDA.
• Whether the disclosure of personal information was permitted without consent for the purpose of collecting a debt under paragraph 7(3)(b) of PIPEDA.

A complainant sought to open an online financial investment account with a FinTech organization. To access the investment account management agreement, the complainant was required to provide personal information, some of which was sensitive. After reviewing the agreement, the complainant decided not to open an account and requested deletion of their personal information. The organization cited "regulatory requirements" for the collection. The OPC clarified that while regulatory requirements exist, they apply once an individual becomes a client, not before. The OPC advised the organization to revise its website so prospective clients could review the agreement without prior personal information disclosure. The organization agreed to revise its website and Privacy Policy, leading to an early resolution.

• Whether a FinTech organization can require personal information before a prospective client reviews terms and conditions
• Whether consent under PIPEDA is meaningful if personal information is collected before a user can review service agreements
• Whether regulatory requirements justify collecting personal information from prospective clients who do not proceed with opening an account