Canadian privacy & access decisions

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by allegedly accessing her wireless Internet connection to post messages on a white supremacist website during an investigation. An Internet Service Provider, responding to a subpoena, linked an IP address associated with the alleged CHRC activity to the complainant. The OPC's investigation found no evidence that the CHRC collected, used, or disclosed any personal information about the complainant or was even aware of her prior to the tribunal hearing. Technological experts suggested the IP address association was a third-party mismatch. The complaint was found to be not well-founded.

• Whether the Canadian Human Rights Commission improperly collected and used the complainant's personal information
• Whether the CHRC accessed the complainant's wireless Internet connection
• Whether an IP address can be considered personal information

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless internet connection to post messages on a white supremacist website. The OPC investigated whether the CHRC contravened sections 4 to 8 of the Privacy Act. The investigation first determined that the complainant's IP address, when linked to her identity via a subpoena, constituted personal information under section 3 of the Act. However, the OPC found no evidence that the CHRC ever collected or had knowledge of the complainant's personal information prior to the allegations. Technological experts suggested the association of the complainant's IP address with the CHRC was likely a third-party mismatch. Consequently, the Assistant Privacy Commissioner concluded there was no contravention of the Privacy Act.

• Whether the complainant's IP address constituted personal information under section 3 of the Privacy Act
• Whether the CHRC collected the complainant's personal information
• Whether the CHRC improperly used, disclosed, or retained the complainant's personal information in contravention of sections 4 to 8 of the Privacy Act

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The service allowed individuals to redirect mail and, with an opt-out clause in fine print, permitted Canada Post to supply new addresses to "mailers" for a fee. The Commissioner found that Canada Post failed to clearly inform customers that their personal information was being sold to organizations like list brokers and direct marketers, and that the consent obtained was not meaningful. Canada Post refused to implement a recommendation for an opt-in checkbox for this disclosure. The Commissioner concluded that Canada Post was in contravention of sections 5(2) and 8 of the Privacy Act for failing to plainly identify the purpose of collection and for disclosing personal information without proper consent.

• Whether Canada Post adequately informed individuals about the purpose of collecting their new address information for the NCOA service, specifically regarding disclosure to "mailers" for commercial purposes under s.5(2) of the Privacy Act
• Whether Canada Post obtained valid consent for the disclosure of new addresses to mass mailers and direct marketers under s.8 of the Privacy Act
• Whether the "opt-out" mechanism used by Canada Post constituted meaningful consent
• Whether the safeguard of only providing new addresses to mailers who already had the customer's name and old address adequately addressed consent concerns