Canadian privacy & access decisions

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5