Canadian Privacy Decisions

This investigation was initiated following media reports that a Canada Revenue Agency (CRA) employee posted personal tax information of athletes to an Internet chat group. The OPC found that a former employee did post information, and other CRA employees inappropriately accessed the athletes' tax information out of curiosity, which constituted a breach of the Privacy Act. The CRA took corrective measures, including disciplinary action against employees and modernization of its audit trail system.

• Unauthorized access to taxpayer information by CRA employees
• Disclosure of taxpayer information to an external party
• Adequacy of CRA's corrective measures and audit systems

A Member of Parliament complained that an employee of the Toronto Port Authority used the organization's e-mail database to invite individuals to a political fundraising event. The investigation found that an employee sent an email using personal and business addresses obtained from business cards, soliciting donations. Although recipient addresses were in the BCC field, the employee's signature block indicated they worked for the Authority, implying institutional sanction.

• Use of institutional database for personal fundraising activities
• Collection and use of personal information for non-business purposes
• Impression of institutional sanction for personal activities

Parents complained they could not access their 17-year-old daughter's online dental benefit information, even though they paid for her plan and expenses. The plan administrator's policy required consent from individuals aged 16 or older before their information could be disclosed to other plan members. The parents were satisfied with the administrator's explanation of its policy, which was based in part on Ontario's Health Care Consent Act.

• Disclosure of dependent's personal information to parents
• Requirement for consent from mature minors
• Application of PIPEDA's consent requirements

A married couple complained that a bank mortgage specialist disclosed the husband's personal financial information to his wife without his consent. The bank argued there was implied consent given the purpose of applying for a joint mortgage. The Assistant Commissioner found the bank did not make a reasonable effort to inform the couple about potential disclosures between them, meaning consent was not meaningful. While a contravention was found, the bank had since adopted reasonable practices.

• Meaningful consent for disclosure of personal information to a spouse
• Reasonable efforts to inform individuals about purposes of disclosure
• Implied consent in the context of joint mortgage applications

This investigation examined a complaint regarding the Royal Canadian Mounted Police's (RCMP) use and disclosure of personal information from the Canadian Firearms Program (CFP) database to a public opinion research firm, EKOS Research Associates Inc. The RCMP contracted EKOS to conduct a survey of firearms licensees to improve program administration and service delivery. The investigation reviewed the contract, security measures, and the survey process.

• Appropriateness of using personal information for a client-satisfaction survey.
• Compliance with contractual confidentiality and security provisions when disclosing information to a third-party contractor.
• Whether the use of information for the survey was consistent with the purpose for which it was originally collected.

The Office of the Privacy Commissioner of Canada (OPC) investigated a Privacy Act complaint after media reported on the leak of a Canadian citizen's personal information from a Department of Foreign Affairs and International Trade (DFAIT) database. The investigation found that DFAIT lacked adequate controls, such as audit trails, to prevent or track unauthorized access and disclosure of the information. DFAIT agreed to implement better guidance and explore system changes to enhance security.

• Adequacy of security measures for personal information held in departmental computer systems.
• Lack of audit trail capability to track access to personal information.
• Responsibility of government institutions to protect personal information under the Privacy Act.

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless Internet connection to post messages to a website during an investigation. The Office found no evidence that the CHRC accessed the complainant's connection or collected any of her personal information. Technological experts suggested the association of the complainant's IP address to the CHRC was likely a mismatch by a third party.

• Whether the CHRC improperly collected and used the complainant's personal information by accessing her Internet connection.
• Whether an IP address constitutes personal information.
• Evidence of unauthorized access to personal information.

This investigation concerned a complaint that Accusearch Inc. (Abika.com), a U.S. company, was collecting, using, and disclosing Canadians' personal information without their knowledge or consent, compiling inaccurate information, and doing so for inappropriate purposes. The OPC found that Abika contravened PIPEDA by collecting, using, and disclosing personal information without knowledge or consent and for inappropriate purposes. However, the complaint regarding inaccurate information was not well-founded due to a lack of objective evidence. The OPC recommended Abika cease these practices.

• Collection, use, and disclosure of personal information without knowledge or consent
• Compilation and disclosure of inaccurate personal information
• Collection, use, and disclosure for inappropriate purposes
• Jurisdiction over U.S. companies and transborder data flows

CIPPIC filed a complaint alleging 24 violations of PIPEDA by Facebook across 12 subjects, focusing on knowledge and consent. The Assistant Privacy Commissioner found Facebook contravened the Act in areas such as default privacy settings, advertising, third-party applications, account deactivation/deletion, deceased users' accounts, and non-users' personal information. While some allegations were resolved through Facebook's proposed corrective measures, others remained unresolved, particularly concerning third-party applications and the safeguarding of user data.

• Adequacy of notice and consent for collection, use, and disclosure of personal information.
• Sufficiency of security safeguards for personal information.
• Transparency regarding new uses of personal information and the implications of privacy settings.
• Handling of personal information of non-users and deceased users.

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information, alleging the CHRC accessed her wireless internet connection to post messages on a website. The investigation examined whether the CHRC contravened sections 4 to 8 of the Privacy Act. Ultimately, the OPC found no evidence that the CHRC collected or used the complainant's personal information, concluding the complaint was not well-founded.

• Whether the IP address constitutes personal information under the Privacy Act.
• Whether the CHRC collected and used the complainant's personal information during its investigations.
• Whether the CHRC improperly disclosed or retained the complainant's personal information.

This investigation concerned a complaint about the Law School Admission Council's (LSAC) requirement that students applying to write the Law School Admission Test (LSAT) in Canada have their fingerprints collected. LSAC, a US-based non-profit, argued that Canadian privacy law did not apply to its activities. The Assistant Privacy Commissioner found that despite LSAC's location, Canada had a sufficient link to LSAC's operations to bring it under the Act. The Commissioner determined that fingerprinting was not demonstrably necessary, likely ineffective, and the loss of privacy outweighed the benefits, particularly since the fingerprints were rarely used.

• Jurisdiction of the Privacy Act over a US-based organization
• Necessity and proportionality of collecting fingerprints for LSAT authentication
• Effectiveness of fingerprinting as a deterrent
• Privacy implications of collecting biometric data

The Office of the Privacy Commissioner of Canada (OPC) investigated Ticketmaster Canada Limited (TM) following a complaint that its practices regarding the collection, disclosure, and use of customer information did not comply with PIPEDA. The investigation found that TM's privacy policy was too long and complex, failing the openness principle. Furthermore, TM was using customer information for marketing purposes without adequately obtaining consent, violating the consent principle. TM has since revised its policies and practices to be more transparent and to provide customers with clear opt-in choices for marketing.

• Adequacy of TM's privacy policy in terms of openness and transparency.
• Lawfulness of using customer personal information for marketing purposes without explicit consent.
• Requirement for opt-in/opt-out mechanisms for secondary uses of personal information.
• Responsibility of TM for ensuring third-party compliance with customer consent preferences.

A former client complained that her lawyer refused to grant her access to her personal information, citing an outstanding account and a solicitor's lien. The OPC found that a solicitor's lien is not a valid reason to deny access under PIPEDA. The lawyer eventually provided the client with her full file, and the matter was settled.

• Can a solicitor's lien be used to deny a client access to their personal information?
• What are the grounds for refusing access to personal information under PIPEDA?

This investigation concerned allegations that SWIFT inappropriately disclosed personal information from Canadian financial institutions to the US Department of the Treasury (UST) via administrative subpoenas. The Privacy Commissioner of Canada determined that SWIFT was subject to PIPEDA due to its operations in Canada and its commercial activities involving Canadian banks. While SWIFT disclosed data held in the US to the UST in response to a subpoena, the Commissioner found this disclosure was permissible under the Act's exceptions to consent.

• Whether SWIFT is subject to PIPEDA
• Whether SWIFT inappropriately disclosed personal information to the UST
• Applicability of PIPEDA exceptions to disclosure in response to a subpoena

This investigation concerned SWIFT's disclosure of personal information originating from Canadian financial institutions to the US Department of the Treasury in response to administrative subpoenas. The OPC found that PIPEDA applied to SWIFT's commercial activities in Canada. However, the Commissioner concluded that SWIFT's disclosure of information to comply with valid US subpoenas was permissible under PIPEDA, interpreting subsection 7(3)(c) to allow compliance with lawful orders from foreign jurisdictions where the organization operates. The Commissioner recommended that US authorities use existing information-sharing mechanisms rather than subpoenas to obtain Canadian financial data.

• Does PIPEDA apply to SWIFT's collection, use, and disclosure of personal information in its Canadian operations?
• Was personal information disclosed to US authorities in accordance with PIPEDA?
• Interpretation of subsection 7(3)(c) regarding compliance with foreign subpoenas.
• Balancing privacy protection with counter-terrorism financing efforts.