Canadian privacy & access decisions

A complaint was filed on behalf of a refugee, alleging that personal information about him was disclosed to a National Post reporter. The refugee was a passenger on the 'Ocean Lady' and was later identified in a news story as a fugitive sought by INTERPOL. The complainant named four federal institutions as potentially responsible for the disclosure: the Canada Border Services Agency, the Canadian Security Intelligence Service, Citizenship and Immigration Canada, and the Royal Canadian Mounted Police. The OPC's investigation confirmed the individual was a wanted fugitive with publicly available INTERPOL information. Due to journalistic confidentiality, the OPC could not determine how the reporter obtained the information. In the absence of evidence, the OPC found no support for the allegation that any of the named institutions disclosed the information.

• Whether any of the named federal institutions disclosed personal information about a refugee to a newspaper reporter
• Whether the publicly available INTERPOL notice constituted a disclosure by the institutions

A woman complained to the OPC after discovering her tax information, held by the Canada Revenue Agency (CRA), was inappropriately accessed by a CRA employee who was the common-law spouse of her ex-husband. The ex-husband subsequently used this information to seek an amendment to a child support arrangement. The CRA's internal investigation confirmed the unauthorized access and disclosure but took 13 months, and the complainant was never informed of the results. The OPC's investigation found the complaint to be well-founded, noting that while the CRA had a discipline policy, allegations of misconduct needed to be addressed more quickly. The OPC also highlighted the need for enhanced privacy training for employees with access to personal tax information.

• Whether the Canada Revenue Agency inappropriately disclosed personal tax information
• Whether the Canada Revenue Agency adequately responded to the internal investigation
• Whether the Canada Revenue Agency's policies and training were sufficient to protect personal information

An individual complained that Veterans Affairs Canada improperly collected his personal information. The individual had contacted Veterans Affairs and the National Capital Commission regarding a monument. Subsequently, a Veterans Affairs official searched the individual's email address on Google, finding a discussion page with personal information. The official then emailed the URL of this page to the entire email thread, stating the individual's email was "public domain." The OPC found that Veterans Affairs did not have a demonstrable need to collect the URL linking to the personal information. The collection of this URL was deemed a violation of the Privacy Act, as collected personal information must relate directly to an operating program or activity. The complaint was well-founded, and Veterans Affairs apologized and deleted the email from its systems.

• Whether the collection of a URL linking to publicly available personal information constitutes collection under the Privacy Act
• Whether the collected personal information related directly to an operating program or activity of Veterans Affairs Canada under section 4 of the Privacy Act

A man complained that Canada Post checked his credit rating when he requested an online change of address. The OPC investigated whether Canada Post's practice of using Equifax for identity verification in online change-of-address requests violated the Privacy Act. The OPC found that Canada Post has a legitimate need to confirm identity to prevent identity theft and that it does not conduct a credit verification. However, the OPC was concerned that individuals were not adequately informed about the sharing of their personal information with Equifax. Canada Post implemented the OPC's recommendations to improve transparency.

• Whether Canada Post's use of Equifax for identity verification constituted a credit check
• Whether Canada Post had the statutory authority to collect personal information for identity verification
• Whether individuals were adequately informed about the sharing of their personal information with Equifax

An individual complained that an RCMP staff sergeant inappropriately disclosed personal information about him at a community meeting. The sergeant, invited to discuss a decade-old murder case, named the complainant as a "person of interest" and stated he had declined a polygraph test. The complainant alleged he was not fully informed about the subject matter of the discussion. The RCMP presumed consent based on the complainant's attendance and assurances from community group representatives. The OPC found that the RCMP had a responsibility to actively obtain consent for the disclosure, rather than presuming it. The complaint was upheld as well-founded.

• Whether the RCMP inappropriately disclosed personal information about the complainant at a community meeting
• Whether the RCMP obtained valid consent for the disclosure of personal information

A woman complained that the Canada Revenue Agency (CRA) disclosed her personal information to a third party without her consent. The complainant, who had not updated her family name in the CRA system, was applying for an adjustment. A CRA employee, attempting to locate her in the system, sent a letter containing the complainant's Social Insurance Number and other personal information to her niece, who shared a similar name and address. The OPC found that this disclosure was due to human error, as the employee failed to follow established procedures for verifying addresses. The CRA acknowledged its mistake and implemented measures to prevent similar incidents. The complaint was found to be well-founded.

• Whether the Canada Revenue Agency disclosed personal information without consent
• Whether the disclosure was due to human error and failure to follow procedures

The adult children of a deceased veteran sought access to their father's pension file from Veterans Affairs Canada to administer his estate. Veterans Affairs refused, citing a 20-year protection period under the Pension Act and the children's ineligibility for pension benefits. The children complained to the OPC, arguing the documents were necessary to determine if pension entitlements were fully paid and if the claim was processed in bad faith. The OPC found it unreasonable for Veterans Affairs to dictate estate information needs. The OPC concluded that under the Privacy Act's Regulations, the complainants were entitled to the file for estate administration. The complaint was upheld as well-founded, and Veterans Affairs subsequently released the file.

• Whether Veterans Affairs Canada was justified in withholding a deceased veteran's pension file from his adult children
• Whether the Pension Act's 20-year protection period for personal information overrides the need for estate administration
• Whether the Privacy Act's Regulations entitle complainants to a deceased pensioner's file for estate administration

An inmate complained that the Correctional Service of Canada (CSC) contravened the Privacy Act by openly posting details of medical appointments. The postings included his name, appointment time, and partial offender number, which were visible to the general penitentiary population. The inmate also alleged similar disclosures for other inmates, including complete offender numbers and other medical information. The CSC acknowledged the breach and committed to notifying inmates individually rather than posting lists. However, the CSC did not agree to use only partial offender numbers on internal employee lists for notifications. The OPC upheld the complaint as well-founded.

• Whether the open posting of inmate medical appointment details constituted an unauthorized disclosure of personal information under the Privacy Act
• Whether the Correctional Service of Canada contravened the Privacy Act by disclosing inmate names, appointment times, and offender numbers to the general penitentiary population

A Canadian Forces member complained that Veterans Affairs Canada (VAC) improperly disclosed the exact percentage of his disability pension to the Department of National Defence (DND) without his consent. This was the second such complaint from the same individual, with a similar complaint in 2008 having been found well-founded. The OPC's investigation found that an agreement between VAC and DND limited information sharing to five specific pieces of information, none of which included the disability percentage. VAC argued the disclosure was in the public interest under subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act, but the OPC found no evidence that the disclosure was deliberate or necessary for the complainant's treatment. The disclosure appeared to be an accidental forwarding of an internal email chain. The OPC found the complaint well-founded and made recommendations to VAC.

• Whether Veterans Affairs Canada disclosed personal information (disability pension percentage) to the Department of National Defence without consent
• Whether the disclosure was in accordance with the information-sharing agreement between VAC and DND
• Whether the disclosure was useful or necessary to facilitate the complainant's medical treatment
• Whether the disclosure qualified under the "public interest" provisions of subsections 8(2)(m)(i) and 8(2)(m)(ii) of the Privacy Act

A woman complained that her personal information, specifically positive drug test results from an ion scan during a prison visit, was inappropriately disclosed to her ex-husband, a Correctional Service of Canada (CSC) employee. Her ex-husband used this information to deny her access to their children. While CSC investigated and found that the ex-husband did not directly access the database, they did not determine how he obtained the information. The OPC's investigation confirmed that the drug test results were indeed disclosed to the ex-husband by other CSC employees, though the specific individuals responsible could not be identified. The OPC found that CSC failed to adequately address the core disclosure issue.

• Whether the woman's personal information (drug test results) was inappropriately disclosed to her ex-husband
• Whether Correctional Service of Canada adequately dealt with the disclosure issue

An individual complained that Canada Post collected excessive personal information for special paid leave requests to care for an ailing relative. The application form, intended for supervisors, was mistakenly given to the complainant to complete, requiring extensive personal information about herself, the ill person, and third parties. Canada Post argued that arbitration rulings and fraud prevention concerns necessitated the collection of substantial information. The OPC found that more personal information was collected than necessary to establish leave entitlement, particularly regarding third parties. The complaint was upheld as well-founded, and the OPC recommended measures to address privacy concerns. Canada Post agreed to some changes, but insisted on collecting information about other family members working at Canada Post, which the OPC still had reservations about.

• Whether Canada Post collected excessive personal information for special paid leave requests
• Whether the information collected about third parties was necessary
• Whether the collection of information about other family members working at Canada Post was justified for fraud prevention

A Canada Post letter carrier complained that his supervisor accessed and used his medical information without authorization. The complainant alleged he gave a sealed medical form for a disability insurance claim to his supervisor to forward to the insurer, but the supervisor opened and read it. The supervisor admitted she might have read the form but denied opening a sealed envelope. The investigation could not confirm if the envelope was sealed, but it did confirm the supervisor used the health information to challenge other medical documentation provided by the employee. The OPC concluded that the personal information was used for an inconsistent purpose without permission, finding the complaint well-founded. The OPC recommended Canada Post remind staff to submit forms directly to the insurer and managers to refuse to accept such forms.

• Whether the supervisor gained unauthorized access to the medical form
• Whether the personal information was used for a purpose inconsistent with its collection
• Whether the use of information was without the complainant's permission

The Minister of Agriculture and Agri-Food Canada filed a privacy complaint against the Canadian Wheat Board (CWB) following media reports about an internal audit. The audit raised concerns about potential improper disclosure of farmers' personal information, including Social Insurance Numbers (SINs), to third parties like grain handlers and the Canada Revenue Agency. The OPC's investigation found that the CWB had appropriate protocols, procedures, and agreements in place to manage personal information. Specifically, the CWB did not disclose SINs to third parties and only shared personal data with the tax agency when legally required. Consequently, the complaint was dismissed as not well-founded.

• Whether the Canadian Wheat Board improperly disclosed farmers' Social Insurance Numbers (SINs) to third parties
• Whether the Canadian Wheat Board improperly disclosed other personal information of farmers to third parties

An individual complained after Health Canada refused to provide him with personal information collected during a fitness-for-work evaluation. Health Canada cited section 28 of the Privacy Act, arguing that disclosing information related to his physical or mental health would be contrary to his best interests. The OPC's investigation found that the requested information was not limited to sensitive health records. Therefore, section 28 did not provide a valid reason to withhold access. The complaint was upheld as well-founded, and Health Canada subsequently agreed to release the information, leading to a resolved outcome.

• Whether Health Canada erred in withholding personal information
• Whether section 28 of the Privacy Act applied to the requested information
• Whether the information was confined to sensitive records related to mental or physical health

An individual complained that the Public Service Commission of Canada (PSC) improperly collected and disclosed personal information about his medical release from the Canadian Forces. This information was collected for a program that grants priority consideration to former military personnel for federal public service positions. The OPC's investigation found that the complainant had provided written consent for the collection and disclosure of his medical release record for this specific hiring program. All aspects of the process were determined to be in full conformity with the Privacy Act. Consequently, the complaint was dismissed.

• Whether the Public Service Commission of Canada improperly collected personal information about the complainant's medical release from the Canadian Forces
• Whether the Public Service Commission of Canada improperly disclosed personal information about the complainant's medical release from the Canadian Forces
• Whether the collection and disclosure of personal information conformed with the Privacy Act