Canadian privacy & access decisions

An individual complained that an insurance company required overly broad consent for the collection, use, and disclosure of personal information when applying for life insurance. The OPC found the company's actual practices were compliant with PIPEDA. However, the company acknowledged the complainant's concerns about the clarity and precision of its consent language. The company agreed to revise its consent forms and share the updated language with the complainant for feedback. The complainant was satisfied with the company's explanation and its commitment to review the consent language. The complaint was settled during the investigation.

• Whether the insurance company's consent language was overly broad
• Whether the insurance company's collection, use, and disclosure practices were consistent with PIPEDA

An individual complained that his former employer, an interprovincial trucking company, disclosed his personal information to a creditor without his consent. The investigation found no evidence to support this allegation; in fact, the complainant had provided some of the information to the creditor himself. During the investigation, the trucking company, a small family-owned business, developed and implemented a written privacy policy, appointed an Information Officer, and reviewed its practices regarding employee information. The company also took steps to ensure its employees were aware of fair information handling practices. Both the complainant and the OPC were satisfied with these actions, and the matter was settled.

• Whether the trucking company disclosed the complainant's personal information to a creditor without consent

A complainant's laptop, returned for repair, was sold by a retail store with her personal information still on it. The individual who purchased the laptop contacted the complainant, raising concerns about the store's safeguards. The investigation revealed an employee sold the returned laptop without wiping its data. The company retrieved the laptop and returned it to the complainant. In response, the store implemented new procedures to ensure all customer data is wiped from returned electronic devices, with documentation required for these actions. The complainant was satisfied with these changes, and the complaint was settled.

• Whether the retail store adequately safeguarded the complainant's personal information on a returned laptop
• Whether the retail store's practices led to an unauthorized disclosure of personal information

A former employee complained that his previous employer, a trucking company, disclosed his personal information to other trucking firms after his employment ended. While the original complaint focused on the disclosure, the Office of the Privacy Commissioner (OPC) also identified the absence of a company privacy policy and a designated privacy representative as issues. Through discussions, both parties reached a settlement. The trucking company agreed to develop privacy policies and procedures, which it subsequently provided to the OPC, and also appointed a privacy officer. The complaint was settled during the investigation.

• Whether a trucking company disclosed personal information about a former employee to other firms without authorization
• Whether the trucking company had adequate privacy policies and procedures in place
• Whether the trucking company had a designated privacy officer

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without consent. The OPC's investigation found merit in the complaint. The lending institution agreed to apologize to the complainant and adjust her outstanding loan. Furthermore, the OPC noted the institution lacked privacy policies and practices. The institution committed to implementing privacy policies, establishing a privacy committee, providing employee training, and reminding staff about limiting information disclosure during debt recovery. Both the complainant and the OPC were satisfied with these actions.

• Whether the lending institution disclosed personal information without consent
• Whether the lending institution had adequate privacy policies and practices in place

A doctor complained that a professional organization ignored his request for access to his personal information. The complainant believed he was the subject of a planned conference talk by a member of the organization and sought access to information related to this presentation. The OPC confirmed that the organization had not acted on the access request. However, the OPC also found that the presentation was never given, and therefore the organization held no personal information about the doctor. The complainant was satisfied with this explanation and withdrew his complaint.

• Whether the professional organization failed to respond to an access request
• Whether the professional organization held personal information about the complainant

An employee of a national transportation company complained about the security of personal information in an automated crew management system. The complainant was concerned that unauthorized personnel, particularly union representatives, could access sensitive data like date of birth, social insurance number, wage rates, and vacation eligibility. While some information was not accessible to union representatives, the company agreed to modify the system. The adjustments ensured that screens would no longer display Social Insurance Numbers, birth dates, and health information. As the complainant's concerns were addressed, the case was considered settled.

• Whether employee personal information in an automated crew management system was adequately protected from unauthorized access
• Whether union representatives had unauthorized access to sensitive employee personal information

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, and disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers of these practices or provide an easy opt-out mechanism. The investigation found that while the company had a privacy policy available online and in booklets, it did not actively bring these practices to the attention of new customers during the service application process. The Assistant Commissioner determined that the company's practices did not meet the reasonable expectations of its customers and thus contravened several PIPEDA principles. The complaint was found to be well-founded, and the Assistant Commissioner recommended that the company draw customers' attention to its privacy policy and options at the time of collection.

• Whether the telecommunications company obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection under Principle 4.2.3
• Whether the company made reasonable efforts to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the company's consent practices met the reasonable expectations of the individual under Principle 4.3.5

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers about its practice of sharing data with affiliates for marketing, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The company maintained that its privacy policy, code, and activation process provided a sufficient basis for customer knowledge and consent, and that it complied with CRTC restrictions on disclosing personal information. The investigation found that the company's privacy documents and activation process constituted a reasonable effort to advise individuals of secondary purposes and that customers could refuse or withdraw consent. The Assistant Commissioner concluded that the company was in compliance with PIPEDA.

• Whether the telecommunications company obtained adequate knowledge and consent for the collection, use, or disclosure of personal information for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection as per Principle 4.2.3
• Whether the company made a reasonable effort to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the form of consent sought by the organization was appropriate given the circumstances and type of information, considering Principle 4.3.4
• Whether the reasonable expectations of the individual were considered in obtaining consent, as per Principle 4.3.5

An individual complained that a bank failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the bank did not adequately inform customers of its data sharing practices with affiliates, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The OPC investigated the bank's privacy materials and processes, finding that the bank provided two privacy documents to customers and had a detailed privacy code available online or in paper format. The bank also had a process where representatives drew attention to privacy policies and recorded customer preferences regarding disclosure to affiliates. The Commissioner found that the bank's materials and processes constituted a reasonable effort to inform individuals and allow them to refuse or withdraw consent. The complaint was therefore found to be not well-founded.

• Whether the bank obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the bank made a reasonable effort to advise individuals of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the purposes were stated in a manner that individuals could reasonably understand, as per Principle 4.3.2
• Whether the bank considered the reasonable expectations of the individual in obtaining consent, as per Principle 4.3.5

The Privacy Commissioner investigated a complaint regarding Canada Post's National Change of Address (NCOA) service. The service allowed individuals to redirect mail and, with an opt-out clause in fine print, permitted Canada Post to supply new addresses to "mailers" for a fee. The Commissioner found that Canada Post failed to clearly inform customers that their personal information was being sold to organizations like list brokers and direct marketers, and that the consent obtained was not meaningful. Canada Post refused to implement a recommendation for an opt-in checkbox for this disclosure. The Commissioner concluded that Canada Post was in contravention of sections 5(2) and 8 of the Privacy Act for failing to plainly identify the purpose of collection and for disclosing personal information without proper consent.

• Whether Canada Post adequately informed individuals about the purpose of collecting their new address information for the NCOA service, specifically regarding disclosure to "mailers" for commercial purposes under s.5(2) of the Privacy Act
• Whether Canada Post obtained valid consent for the disclosure of new addresses to mass mailers and direct marketers under s.8 of the Privacy Act
• Whether the "opt-out" mechanism used by Canada Post constituted meaningful consent
• Whether the safeguard of only providing new addresses to mailers who already had the customer's name and old address adequately addressed consent concerns

The OPC initiated an investigation after a news report revealed an Ottawa-based website was streaming live cell phone conversations. The website was using a scanner to intercept cellular telephone traffic and broadcasting it online. During the investigation, the Internet Service Provider (ISP) hosting the website shut it down due to bandwidth issues. The ISP also terminated an employee who was responsible for the unauthorized data forwarding. The website reportedly moved to a New York server under new management. Given the shutdown of the Ottawa-based site, the OPC discontinued its investigation.

• Whether broadcasting cell phone conversations without consent constitutes unauthorized collection, use, or disclosure of personal information under PIPEDA
• Whether the OPC should continue an investigation when the alleged activity has ceased

The federal Privacy Commissioner investigated a complaint regarding Centurion Security Services' installation of surveillance cameras at a downtown Yellowknife intersection. The Commissioner found that both live and recorded video images of individuals constitute "personal information" under PIPEDA. Centurion Security Services, a private company, was monitoring public spaces for commercial purposes without the consent of individuals, which contravened Principle 4.3 of Schedule 1 and section 5(1) of the Act. Although the cameras were removed before the complaint was received, the Commissioner concluded that Centurion's intended future public video surveillance for commercial purposes would also be unlawful. The complaint was found to be well-founded.

• Whether the subject matter falls within the Commissioner's jurisdiction under PIPEDA
• Whether live video pictures of individuals constitute "personal information" under section 2 of PIPEDA
• Whether the collection of personal information was in the course of a commercial activity under section 4 of PIPEDA
• Whether Centurion Security Services collected personal information without consent in contravention of Principle 4.3 of Schedule 1 of PIPEDA
• Whether the absence of recording (live feed only) affects the classification of information as personal information or the requirement for consent

A complaint was made against a transportation company alleging that its sales agents were collecting passengers' date of birth and citizenship for Toronto-to-New York train bookings and disclosing this information to US Customs and US Naturalization and Immigration Service. The company confirmed this practice, stating it was an agreement with US authorities to minimize border delays. The OPC found that sales agents were representing the provision of this information as a requirement. The OPC advised the company to instruct its agents to present the provision of this information as voluntary and to seek consent after booking. The company issued a directive to its sales agents, and the OPC closed the file, subject to monitoring.

• Whether the transportation company was collecting personal information without proper consent
• Whether the transportation company was disclosing personal information without proper consent
• Whether sales agents were misrepresenting the voluntary nature of providing personal information

The complainant alleged that a federal institution failed to respond to an access request within the statutory 30-day period or an extended period, resulting in a deemed refusal under subsection 10(3) of the Access to Information Act. The complainant submitted their complaint on January 21, 2025, arguing that the deemed refusal was 'ongoing' and therefore the 60-day time limit for complaints under section 31 should not apply from the initial awareness date. The OIC requested clarification on when the complainant first became aware of the institution's failure to respond, but the complainant maintained their 'ongoing refusal' position. The OIC determined that the complaint was inadmissible because it was not submitted within the mandatory 60-day time limit from when the complainant first became aware of the grounds for complaint. The Commissioner rejected the argument that an 'ongoing' deemed refusal continuously restarts the complaint period, citing Federal Court precedent and emphasizing that the Act does not grant the Commissioner power to extend this time limit.

• Whether the complaint was submitted within the 60-day time limit prescribed by section 31 of the Access to Information Act
• Whether an 'ongoing' deemed refusal under subsection 10(3) of the Act continuously restarts the 60-day complaint period under section 31
• Whether the Information Commissioner has the power to extend the 60-day time limit for submitting complaints