Canadian privacy & access decisions

The OPC investigated a complaint against the RCMP regarding the use and disclosure of personal information from the Canadian Firearms Program (CFP) to EKOS Research Associates Inc. for a survey of firearms licensees. The investigation examined whether the RCMP improperly used or disclosed personal information in contravention of sections 7 and 8 of the Privacy Act. The OPC found that the use of information for a client-satisfaction survey to improve CFP services was consistent with the original collection purpose, thus not contravening section 7. Furthermore, the disclosure to EKOS, acting as an agent under a contract with confidentiality and security provisions, did not contravene section 8. The complaint was therefore deemed not well-founded. The OPC noted that the CFP committed to updating its InfoSource entry and website to better inform the public about information use for surveys and acknowledged that a Privacy Impact Assessment would have been beneficial.

• Whether the use of personal information for a client-satisfaction survey was consistent with the purpose for which it was obtained or compiled under s.7(a) of the Privacy Act
• Whether the disclosure of personal information to EKOS Research Associates Inc. for the survey contravened s.8 of the Privacy Act
• Whether the personal information collected by the RCMP related directly to an operating program or activity of the institution under s.4 of the Privacy Act

The OPC investigated a complaint regarding the leak of a Canadian citizen's personal information from a DFAIT database, which was reported in the media in spring 2008. The investigation confirmed the information was held in an official consular record within DFAIT's computer system. A significant concern was that 1,231 DFAIT employees had access to these files, and the system lacked audit trail capabilities or mechanisms to restrict access to specific records. Consequently, the OPC could not identify the source of the leak. The complaint was found to be well-founded, and DFAIT agreed to implement corrective measures.

• Whether personal information was leaked from a DFAIT database
• Whether DFAIT's security safeguards were adequate to protect personal information
• Whether DFAIT's computer system had sufficient audit trail capabilities
• Whether DFAIT's computer system had mechanisms to restrict access to particular files

A woman complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by allegedly accessing her wireless Internet connection to post messages on a white supremacist website during an investigation. An Internet Service Provider, responding to a subpoena, linked an IP address associated with the alleged CHRC activity to the complainant. The OPC's investigation found no evidence that the CHRC collected, used, or disclosed any personal information about the complainant or was even aware of her prior to the tribunal hearing. Technological experts suggested the IP address association was a third-party mismatch. The complaint was found to be not well-founded.

• Whether the Canadian Human Rights Commission improperly collected and used the complainant's personal information
• Whether the CHRC accessed the complainant's wireless Internet connection
• Whether an IP address can be considered personal information

CIPPIC complained that Abika.com, a U.S. company, collected, used, and disclosed Canadians' personal information without consent, compiled and disclosed inaccurate personal information through its "psychological profile" service, and used personal information for inappropriate purposes. The OPC initially declined jurisdiction, but the Federal Court ordered the investigation to proceed. The OPC found that Abika collected and disclosed personal information, including telephone records, of Canadians without their knowledge or consent, often for inappropriate purposes such as investigating partners. While the OPC found the accuracy complaint not well-founded due to lack of verifiable evidence, it concluded that Abika contravened PIPEDA Principles 4.3 and subsection 5(3). Abika failed to respond adequately to the OPC's recommendations.

• Whether Abika collected, used, and disclosed personal information of individuals living in Canada without their knowledge and consent, in contravention of Principle 4.3
• Whether Abika compiled and disclosed inaccurate personal information through its "psychological profile" service, in contravention of Principle 4.6
• Whether Abika collected, used, and disclosed personal information about Canadians for inappropriate purposes, in contravention of subsection 5(3)

The Canadian Internet Policy and Public Interest Clinic (CIPPIC) filed a comprehensive complaint against Facebook Inc., alleging 24 contraventions of PIPEDA across 12 subjects, including default privacy settings, advertising practices, third-party applications, and the handling of personal information for deactivated, deceased, and non-users. The Office of the Privacy Commissioner (OPC) focused its investigation on meaningful consent, retention, and security safeguards. The Assistant Commissioner found several allegations to be 'not well-founded', such as those concerning new uses of information, collection from other sources, Facebook Mobile safeguards, and deception. Other allegations, including those related to date of birth collection, default privacy settings, advertising, and monitoring for anomalous activity, were found 'well-founded and resolved' due to Facebook's agreement to implement corrective measures. However, significant issues regarding third-party applications, indefinite retention of deactivated account data, inadequate notification for deceased users' accounts, and the collection/retention of non-users' personal information were found 'well-founded' but remained unresolved, as Facebook declined to implement key recommendations. The OPC indicated it would follow up on all recommendations and consider further action for unresolved issues.

• Whether requiring date of birth as a condition of registration contravened Principle 4.3.3
• Whether Facebook adequately explained the purposes for collecting and using date of birth under Principle 4.3.2
• Whether default privacy settings constituted improper opt-out consent for sensitive information under Principle 4.3.6
• Whether Facebook made reasonable efforts to advise users of purposes and extent of information use/disclosure via default settings under Principles 4.2.3 and 4.3.2
• Whether default settings for photo albums met users' reasonable expectations under Principle 4.3.5
• Whether default settings for public search listings met users' reasonable expectations under Principle 4.3.5
• Whether Facebook made reasonable efforts to notify users of advertising purposes under Principle 4.3.2
• Whether Social Ads improperly used opt-out consent for sensitive information under Principle 4.3.6
• Whether users could opt out of Facebook Ads under Principle 4.3.8
• Whether requiring consent to Facebook Ads as a condition of service violated Principle 4.3.3
• Whether Facebook adequately informed users of the purpose for disclosing personal information to third-party application developers under Principles 4.2.2 and 4.2.5
• Whether Facebook provided third-party application developers with access to personal information beyond what was necessary under Principle 4.4.1
• Whether Facebook required consent to disclosure beyond what was necessary to run an application under Principle 4.3.3
• Whether Facebook adequately safeguarded personal information transferred to third-party applications under Principle 4.7
• Whether Facebook obtained meaningful consent for disclosure of personal information to application developers when users or their friends added applications under Principles 4.2, 4.2.3, 4.3.2, 4.3.4, 4.3.5, 4.3.6, and subsection 5(3)
• Whether Facebook failed to notify users of new purposes for collecting, using, or disclosing personal information under Principle 4.2.4
• Whether Facebook failed to provide specific information and obtain meaningful consent for collecting personal information from sources outside Facebook under Principle 4.3
• Whether Facebook inappropriately deprived users of a means to delete all personal information from the site
• Whether Facebook's indefinite retention of personal information in deactivated accounts contravened Principles 4.5 and 4.5.3
• Whether Facebook obtained meaningful consent for memorializing deceased users' profiles under Principle 4.3.3
• Whether memorializing profiles was an unnecessary condition of service under Principle 4.3.3
• Whether Facebook adequately informed users of its practice of account memorialization under Principles 4.2.1, 4.2.3, 4.3.2, and 4.8
• Whether Facebook obtained consent from non-users for uploading their personal information (e.g., tagging, invitations) under Principle 4.3
• Whether Facebook's retention of non-users' email addresses beyond the initial purpose contravened Principle 4.5
• Whether Facebook Mobile's use of a persistent cookie constituted inadequate safeguarding of personal information under Principles 4.7, 4.7.1, and 4.7.3
• Whether Facebook adequately informed users of its practice of monitoring for anomalous activity under Principle 4.8
• Whether Facebook misrepresented its purpose or users' control over personal information under Principles 4.3.2 and 4.4.2

An individual complained that the Canadian Human Rights Commission (CHRC) improperly collected and used her personal information by accessing her wireless internet connection to post messages on a white supremacist website. The OPC investigated whether the CHRC contravened sections 4 to 8 of the Privacy Act. The investigation first determined that the complainant's IP address, when linked to her identity via a subpoena, constituted personal information under section 3 of the Act. However, the OPC found no evidence that the CHRC ever collected or had knowledge of the complainant's personal information prior to the allegations. Technological experts suggested the association of the complainant's IP address with the CHRC was likely a third-party mismatch. Consequently, the Assistant Privacy Commissioner concluded there was no contravention of the Privacy Act.

• Whether the complainant's IP address constituted personal information under section 3 of the Privacy Act
• Whether the CHRC collected the complainant's personal information
• Whether the CHRC improperly used, disclosed, or retained the complainant's personal information in contravention of sections 4 to 8 of the Privacy Act

A complainant objected to the Law School Admission Council's (LSAC) requirement for Canadian students to provide fingerprints to write the Law School Admission Test (LSAT). LSAC, a US-based non-profit, argued it was outside PIPEDA's jurisdiction and its activities were educational. The Assistant Privacy Commissioner found sufficient links to Canada for PIPEDA to apply and determined LSAC's activities were administrative, not educational. Applying a four-part test, the Assistant Commissioner found fingerprinting was not demonstrably necessary, effective, or proportional, and less privacy-invasive alternatives existed. LSAC agreed to cease fingerprint collection but reserved the right to reinstate it, proposing photographic evidence instead. The Assistant Commissioner found the complaint well-founded due to the disproportionate nature of fingerprint collection and LSAC's reservation to reinstate the policy.

• Whether LSAC's activities fall within the scope of PIPEDA despite its non-profit status and US location
• Whether LSAC's activities are educational in nature or serve administrative needs
• Whether the collection of thumbprints is demonstrably necessary to meet a specific need
• Whether the collection of thumbprints is likely to be effective in meeting that need
• Whether the loss of privacy from thumbprint collection is proportional to the benefit gained
• Whether there is a less privacy-invasive way of achieving the same end as thumbprint collection
• Whether the collection of photographs as an alternative is acceptable under PIPEDA
• Whether LSAC's reservation of the right to reinstate its fingerprint policy is compliant with PIPEDA

The OPC investigated Ticketmaster Canada Limited (TM) following a complaint that its practices for collecting, disclosing, and using customer personal information for marketing purposes did not comply with PIPEDA. The complainant alleged that customers were not properly informed or given a viable alternative to sharing their information for marketing. The Assistant Privacy Commissioner found that TM failed to uphold the principles of openness and consent. TM subsequently revised its privacy policy and online notifications to explicitly communicate information sharing practices and provide clear opt-in options for marketing. The investigation concluded that the issues were resolved satisfactorily, but the Assistant Commissioner expressed concern about the well-founded violations several years after PIPEDA's enactment.

• Whether Ticketmaster's privacy policy met the openness principle of PIPEDA
• Whether Ticketmaster obtained valid consent for the use of personal information for marketing purposes
• Whether customers were properly informed about the use of their personal information for marketing
• Whether customers were provided a viable opt-in/opt-out option for marketing without penalty
• Whether Ticketmaster's agreements with event providers ensured compliance with customer preferences

A client sought access to her personal information from her former lawyer. The lawyer refused access, citing outstanding fees and asserting a solicitor's lien on the client's file, believing that providing access could jeopardize payment. The OPC noted that PIPEDA's subsection 9(3) provides an exhaustive list of reasons for refusing access, which does not include a solicitor's lien. Therefore, lawyers must grant access to personal information even if a valid lien exists. The OPC suggested that allowing the individual to view, but not copy, the information could balance the right to access with the lien. The lawyer subsequently provided a complete copy of the file, and the complaint was settled.

• Whether a solicitor's lien is a valid ground to refuse access to personal information under PIPEDA
• Whether subsection 9(3) of PIPEDA provides an exhaustive list of circumstances for refusing access

The Privacy Commissioner of Canada initiated a complaint against SWIFT SCRL (Society for Worldwide Interbank Financial Telecommunication) for allegedly disclosing personal information originating from or transferred to Canadian financial institutions to the US Department of the Treasury (UST) in response to administrative subpoenas. SWIFT, a global financial messaging service, argued it was legally compelled to comply with valid US subpoenas and had negotiated privacy protections with the UST. The OPC first determined that the Personal Information Protection and Electronic Documents Act (PIPEDA) applied to SWIFT due to its significant presence and commercial activities in Canada. The key issue was whether SWIFT's disclosure without consent complied with PIPEDA, specifically the exception for subpoenas under paragraph 7(3)(c) and the appropriateness of the disclosure under subsection 5(3). The Commissioner concluded that paragraph 7(3)(c) allows for compliance with valid foreign subpoenas when an organization operates in multiple jurisdictions and legitimately stores data abroad, and that the disclosure was appropriate given the legal compulsion and privacy safeguards SWIFT negotiated. Consequently, the complaint was found not well-founded, as SWIFT's actions did not contravene PIPEDA. The Commissioner, however, recommended that the Canadian government engage with US counterparts to encourage the use of existing information-sharing mechanisms with built-in privacy protections, and noted SWIFT's efforts to explore enhanced privacy solutions.

• Whether the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to SWIFT’s collection, use, and disclosure of personal information in the course of its operations in Canada.
• Whether SWIFT is engaged in a commercial activity within Canada under paragraph 4(1)(a) of PIPEDA.
• Whether personal information collected by SWIFT from Canadian financial institutions was disclosed to US authorities in accordance with PIPEDA.
• Whether the disclosure of personal information without knowledge or consent was permitted under paragraph 7(3)(c) of PIPEDA (subpoena exception).
• Whether a "subpoena or warrant" under paragraph 7(3)(c) must be issued only by a body within Canada.
• Whether SWIFT’s disclosure to the UST was appropriate in the circumstances, as per subsection 5(3) of PIPEDA.

The Privacy Commissioner of Canada launched an investigation into SWIFT SCRL following allegations that it disclosed personal information originating from or transferred to Canadian financial institutions to the US Department of the Treasury (UST) via administrative subpoenas. SWIFT provides messaging services to financial institutions globally, and some messages contain personal information. The Commissioner determined that SWIFT was subject to PIPEDA due to its operations and significant presence in Canada. While acknowledging SWIFT's compliance with US laws, the Commissioner found that SWIFT had not contravened PIPEDA, as the Act allows for disclosure without consent in response to a subpoena from a body with jurisdiction to compel information. The Commissioner emphasized that organizations operating in Canada must still abide by PIPEDA, even when subject to foreign laws. She also recommended that US authorities use existing information-sharing mechanisms with built-in privacy protections rather than subpoenas for Canadian-related financial information.

• Whether SWIFT is subject to PIPEDA
• Whether SWIFT contravened PIPEDA by disclosing personal information to the US Department of the Treasury
• Whether the exception to consent for disclosures in response to a subpoena applies

An individual complained that a department store's method of collecting tax exemption information allowed other customers to view her personal data and the data of previous customers. The store used a petition-style form where customers wrote their names, shopping dates, and tax exemption numbers, making this information visible to subsequent customers. The complainant was concerned about the lack of privacy for her personal information. In response to the complaint, the department store first implemented a temporary measure of using a new form where only one customer's information appeared per page. Subsequently, the store reconfigured its cash registers to electronically print a receipt-style form for tax exemptions, which was then completed by the customer and securely stored in the register. This new electronic system prevented customers from viewing each other's personal information. The complainant was satisfied with these changes, and the matter was considered settled.

• Whether the department store's method of collecting tax exemption information allowed unauthorized disclosure of personal information to other customers
• Whether the department store adequately safeguarded customers' personal information

An individual complained that a DVD-rental store required him to provide his driver's license details for entry into their database to become a member, which he believed was unnecessary. The store initially argued this was a business necessity for identity verification and recovering overdue rentals. However, the investigation revealed the store did not use driver's license data for tracing members, but rather publicly available information. Recognizing it was collecting unnecessary information, the store revised its membership process. Under the new process, customers must present two pieces of identification, one with a photo, but driver's license details are no longer entered into the database. The store committed to updating its procedures and training staff on the new process.

• Whether collecting and recording driver's license details was necessary for the DVD-rental store's operations
• Whether the store's collection practices aligned with the principle of limiting collection to necessary information

The OPC investigated two incidents involving misdirected faxes from two banks, which resulted in personal information being sent to unintended recipients over several years. In both cases, the recipients attempted to notify the banks, but the issues were not escalated or resolved until media reports brought them to public attention. The investigations found that the banks failed to adequately safeguard personal information and ensure their privacy policies were effectively implemented by employees. While the banks took corrective measures during the investigation, the OPC made further recommendations to improve internal communication of breaches, customer notification, fax transmission verification, and recovery of misdirected information. Both banks fully implemented these recommendations.

• Whether organizations adequately safeguard personal information to prevent inappropriate disclosure (Principle 4.7 PIPEDA)
• Whether organizations implement effective policies and procedures to give effect to fair information practices (Principle 4.1 PIPEDA)
• Whether employees are attuned to privacy issues and can respond to problems when they arise
• Whether organizations notify affected customers of privacy breaches
• Whether organizations have processes for confirming correct fax transmission
• Whether organizations have measures to recover erroneously transmitted customer information

A complainant alleged that a counselling firm, part of her employer's Employee Assistance Program (EAP), improperly disclosed sensitive personal information to her employer and others. The firm revealed she was using counselling services and believed she was a danger to herself, which the complainant disputed as a misinterpretation. The OPC's investigation found that a miscommunication occurred during a phone call between the complainant and her counsellor regarding the meaning of "having a plan." The counsellor, believing the complainant was suicidal, contacted emergency services, including the complainant's workplace. The police later concluded the complainant posed no danger. The counselling firm and the complainant reached a private settlement with the OPC's involvement. The firm subsequently revised its policies on disclosing personal information, emphasizing detailed case notes and limiting information shared with emergency services.

• Whether the counselling firm improperly disclosed personal information about the complainant to her employer and others
• Whether the information disclosed by the counselling firm was inaccurate
• Whether the counsellor misconstrued the complainant's statements during a telephone conversation
• Whether the counselling firm's disclosure of personal information was justified under circumstances of perceived imminent danger