Canadian privacy & access decisions

A former inmate at Toronto's Keele Community Correctional Centre complained after a psychiatric nurse employed by the facility left an envelope containing his treatment notes on public transit. The director of the centre acknowledged the privacy breach, apologized, and stated that internal actions were taken to prevent recurrence. The nurse was reminded of his duty to safeguard personal information and not to transport patient files from the office unless encrypted. The OPC's investigation confirmed the privacy breach and found the complaint to be well-founded. However, the OPC also concluded that the facility had taken appropriate corrective measures following the incident.

• Whether the psychiatric nurse's actions constituted a privacy breach
• Whether the institution took appropriate corrective measures after the breach

An inmate at Kent Institution complained after a 10-page National Parole Board decision containing graphic details of his offence was intercepted and circulated among other inmates. The document was supposed to be delivered via internal mail but was only folded and stapled, not placed in an envelope. Prison officials acknowledged the breach and launched an investigation, which confirmed the document was viewed by various inmates. The OPC's investigation found that the disclosure violated the Privacy Act. As a result, the warden implemented changes to ensure confidential documents are now placed in sealed envelopes.

• Whether the disclosure of the inmate's National Parole Board decision to other inmates violated the Privacy Act

Two prisoners at the Correctional Service of Canada’s Grande Cache Institution filed complaints after a prison report containing their personal information was found among a fellow inmate's personal effects. An investigation revealed that a contract worker had printed the report, which listed personal information of all inmates, and given it to a welding instructor. The report was later discovered in an offender's belongings, though it was unclear how it got there. Correctional Service officials acknowledged the privacy breach and implemented several corrective measures, including restricting the printing of such reports and reinforcing training on safeguarding personal information. The OPC's investigation confirmed a breach of the complainants' privacy rights. Due to the corrective actions already taken, the OPC did not require further action.

• Whether the personal information of inmates was inappropriately disclosed
• Whether the Correctional Service of Canada adequately safeguarded personal information

A woman complained to the OPC after an attendance sheet containing her Social Insurance Number (SIN), name, and telephone number, along with those of 31 other employment insurance (EI) claimants, went missing from an HRSDC information session. HRSDC officials notified affected individuals, apologized, and provided information on identity theft protection. The OPC investigated and found that HRSDC had failed to properly safeguard the personal information. The OPC was particularly concerned that the breach involved SINs, which are highly vulnerable to misuse. HRSDC subsequently directed officials to black out SINs on attendance sheets for future sessions.

• Whether Human Resources and Skills Development Canada (HRSDC) properly safeguarded personal information, specifically Social Insurance Numbers (SINs), names, and telephone numbers, on an attendance sheet at an employment insurance information session.

An individual complained that Canada Post required his driver's licence number to terminate his postal box rental. Canada Post stated it requires personal identification to prevent fraudulent use or closure of postal boxes and has used recorded ID to investigate illegal shipments. The OPC's investigation found that Canada Post has a statutory obligation to provide a secure postal service. The collection and use of personal information, including driver's licence numbers, was deemed consistent with this mandate. The OPC concluded that the collection of identification numbers was reasonable. The complaint was dismissed as not well-founded.

• Whether requiring a driver's licence number to terminate a postal box rental is a reasonable collection of personal information under PIPEDA
• Whether Canada Post's collection and use of personal information for security purposes is consistent with its statutory obligations

A veteran complained that Veterans Affairs Canada (VAC) inappropriately used his personal information by including excessive medical details in briefing notes for the Minister and by transferring his medical file to a hospital without consent. The OPC investigation found that briefing notes contained sensitive medical information far beyond what was necessary for their stated purpose and that this information was widely shared within VAC on a non-need-to-know basis. It also found that VAC transferred the complainant's medical file to a hospital it administered without obtaining his consent, despite departmental guidelines requiring it. The OPC concluded that VAC's actions violated section 7 of the Privacy Act, which governs the use of personal information. The complaint was found to be well-founded, and the OPC issued several recommendations to VAC, including developing an enhanced privacy policy framework, revising information-management practices, providing employee training, and reviewing consent procedures for information transfers.

• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by including excessive medical details in briefing notes for the Minister.
• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by widely sharing sensitive personal information within the department on a non-need-to-know basis.
• Whether Veterans Affairs Canada used the complainant's personal information for purposes not consistent with the purpose for which it was obtained or compiled, without consent, in contravention of section 7 of the Privacy Act, by transferring his medical file to a hospital without obtaining his consent.

The Commissioner initiated a complaint against the RCMP regarding its handling of personal information collected by the Canadian Firearms Program and used by EKOS Research Associates Inc. to survey firearms licensees. The RCMP provided contact information to EKOS, which then collected demographic data and information on guns owned by respondents. The investigation found that EKOS did not provide identifying data in its report to the firearms program and met all contractual requirements for secure data handling. The Assistant Commissioner determined that the collection and use of information for a client-satisfaction survey was consistent with the purpose for which it was initially collected under the Privacy Act. The RCMP was also found compliant in providing information to EKOS, as the contract included appropriate confidentiality and security provisions. The complaint was therefore deemed not well-founded, though the OPC recommended the RCMP clarify its public information on data uses and conduct Privacy Impact Assessments.

• Whether the collection of personal information by the Canadian Firearms Program for a client-satisfaction survey was consistent with the purpose for which it was initially collected under the Privacy Act
• Whether the disclosure of personal information by the RCMP to EKOS Research Associates Inc. for the survey was compliant with the Privacy Act

An individual complained that the Canada Border Services Agency (CBSA) improperly collected information from his personal online blog after his term position ended. The complainant alleged that his tracking device showed visits from government computers. The OPC investigated whether the CBSA had inappropriately collected personal information. The investigation found that several CBSA employees had viewed the blog, but did so in a personal capacity, which was deemed to accord with the government's Acceptable Use Policy. The OPC found no evidence that the agency had collected personal information in connection with these visits. Therefore, the complaints were determined to be not well-founded.

• Whether the Canada Border Services Agency improperly collected personal information from the complainant's blog
• Whether employees viewing a public blog from government workstations constitutes collection of personal information by the agency

In March 2009, Human Resources and Skills Development Canada (HRSDC) mailed 11,900 forms for the Guaranteed Income Supplement. Due to a mechanical malfunction and human error, some individuals received forms intended for others, containing names, addresses, and Social Insurance Numbers (SINs). The OPC initiated a complaint after HRSDC notified them of 44 reported cases of mix-ups. The investigation found that a technician failed to stop the mailing despite noticing errors and did not report the issue to management. The OPC determined the complaint was well-founded, highlighting both mechanical failure and human error. HRSDC conducted its own investigation, improved equipment, and strengthened quality control procedures. The OPC recommended better employee sensitization to privacy obligations, which HRSDC committed to implementing.

• Whether personal information was inappropriately disclosed due to mechanical malfunction
• Whether personal information was inappropriately disclosed due to human error
• Whether the institution adequately safeguarded personal information during mass mailings
• Whether employees were sufficiently sensitized to their obligations to safeguard personal information

A Member of Parliament complained that an employee of the Toronto Port Authority (TPA) misused the organization's email database to invite people to a political fundraising event. The investigation found that a TPA employee sent an email to approximately 60 people, soliciting donations and inviting participation in a fundraiser for another MP. The employee obtained these email addresses from business cards collected by the TPA, including both business and personal addresses. The OPC determined that the employee used this personal information without the TPA's knowledge or authorization and for reasons unrelated to the organization's business activities. The complaint was found to be well-founded, but the TPA took corrective measures, including reminding employees of their responsibilities and pledging Privacy Act training.

• Whether a Toronto Port Authority employee misused personal information for a political fundraiser
• Whether email addresses obtained from business cards constitute personal information
• Whether the use of personal information was without the knowledge or authorization of the institution
• Whether the use of personal information was for reasons unrelated to the organization's business activities

The Office of the Privacy Commissioner of Canada (OPC) received 82 complaints after Human Resources and Skills Development Canada (HRSDC) inadvertently disclosed the personal information of 191 Employment Insurance (EI) claimants to another individual. The disclosure occurred when an individual appealing an EI claim denial received an appeal docket that included names, dates of birth, employee identification numbers, and Social Insurance Numbers of 191 fellow employees, along with a second list of employment and leave statuses. The OPC's investigation confirmed that in 79 instances, the information was indeed released, leading to well-founded findings. HRSDC took immediate steps to retrieve the data, notify affected parties, and advise on identity theft prevention. They also implemented measures to prevent future recurrences, including reminding officials of proper procedures for protecting personal information during appeals.

• Whether Human Resources and Skills Development Canada inadvertently disclosed personal information of EI claimants
• Whether the disclosure of names, dates of birth, employee identification numbers, and Social Insurance Numbers constituted a contravention of the Privacy Act
• Whether the disclosure of employment and leave status constituted a contravention of the Privacy Act

The Commissioner initiated an investigation following media allegations that a Canada Revenue Agency (CRA) employee posted personal tax information of high-profile sports figures to an Internet chat group. The investigation confirmed that a former CRA employee had posted such information, and that other CRA employees had inappropriately accessed the tax information of these athletes, likely out of curiosity. While there was no evidence that these employees disclosed the information to outside sources, accessing personal tax information without authorization and for purposes unrelated to duties constitutes a breach of the Privacy Act. Consequently, the portion of the complaint concerning the improper use of personal information by CRA employees was found to be well-founded. The CRA took corrective measures, including suspending one employee, firing two others, and modernizing its audit trail system to monitor access to taxpayer information.

• Whether CRA employees inappropriately accessed personal tax information
• Whether CRA employees disclosed personal tax information to outside sources
• Whether accessing personal tax information without authorization and for purposes unrelated to duties constitutes a breach of the Privacy Act

A public servant complained that Public Works and Government Services Canada (PWGSC) refused to provide her with personal information collected during an investigation under the Public Servants Disclosure Protection Act, which had exonerated her. The OPC found that PWGSC correctly applied section 22.3 of the Privacy Act, which mandates refusal to disclose information created for whistleblower disclosures or related investigations. Therefore, the complaint was not well-founded regarding access to information. However, the OPC was concerned that individuals cleared of wrongdoing were not informed of their vindication. The OPC urged PWGSC to inform subjects when allegations are unsubstantiated, and PWGSC subsequently did so for the complainant. The Commissioner also asked the Treasury Board Secretariat to develop guidelines for all departments to inform individuals when allegations of wrongdoing are unsubstantiated, citing procedural fairness and natural justice.

• Whether the complainant had a right to access personal information collected during a whistleblower investigation
• Whether section 22.3 of the Privacy Act was correctly applied to refuse disclosure
• Whether individuals cleared of wrongdoing in whistleblower investigations should be informed of their vindication

The OPC investigated a complaint against the RCMP regarding the use and disclosure of personal information from the Canadian Firearms Program (CFP) to EKOS Research Associates Inc. for a survey of firearms licensees. The investigation examined whether the RCMP improperly used or disclosed personal information in contravention of sections 7 and 8 of the Privacy Act. The OPC found that the use of information for a client-satisfaction survey to improve CFP services was consistent with the original collection purpose, thus not contravening section 7. Furthermore, the disclosure to EKOS, acting as an agent under a contract with confidentiality and security provisions, did not contravene section 8. The complaint was therefore deemed not well-founded. The OPC noted that the CFP committed to updating its InfoSource entry and website to better inform the public about information use for surveys and acknowledged that a Privacy Impact Assessment would have been beneficial.

• Whether the use of personal information for a client-satisfaction survey was consistent with the purpose for which it was obtained or compiled under s.7(a) of the Privacy Act
• Whether the disclosure of personal information to EKOS Research Associates Inc. for the survey contravened s.8 of the Privacy Act
• Whether the personal information collected by the RCMP related directly to an operating program or activity of the institution under s.4 of the Privacy Act

The OPC investigated a complaint regarding the leak of a Canadian citizen's personal information from a DFAIT database, which was reported in the media in spring 2008. The investigation confirmed the information was held in an official consular record within DFAIT's computer system. A significant concern was that 1,231 DFAIT employees had access to these files, and the system lacked audit trail capabilities or mechanisms to restrict access to specific records. Consequently, the OPC could not identify the source of the leak. The complaint was found to be well-founded, and DFAIT agreed to implement corrective measures.

• Whether personal information was leaked from a DFAIT database
• Whether DFAIT's security safeguards were adequate to protect personal information
• Whether DFAIT's computer system had sufficient audit trail capabilities
• Whether DFAIT's computer system had mechanisms to restrict access to particular files