Canadian Privacy Decisions

The complainant alleged that his employer disclosed detailed personal information about his absence from the workplace to other employees. The organization used an electronic scheduling program that allowed all employees to view the reasons for colleagues' absences. The OPC found that this disclosure constituted a contravention of PIPEDA, as the organization's purposes were not appropriate and less privacy-intrusive means were available to manage employee schedules and shift exchanges. The organization committed to removing the detailed leave information from its systems.

• Appropriate purposes for disclosure of personal information
• Balancing employee privacy with operational needs
• Necessity of disclosing reasons for absence
• Interpretation of collective agreement obligations

A complainant alleged that his Internet Service Provider (ISP) disclosed his personal information without consent to a newspaper columnist who was assisting him with a service dispute. The ISP argued it had implied consent due to the complainant's actions. The OPC found that the complainant's familiarity with the columnist and his own disclosure of information in his email to the columnist created a reasonable expectation that his information might be shared to resolve the dispute. The disclosed information was also found to be relevant and not sensitive.

• Was there implied consent for the disclosure of personal information to a columnist assisting with a dispute?
• Was the disclosed information relevant to the complaint?
• Was the disclosed information sensitive?

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding an equipment store's policy of photocopying customers' driver's licences as a condition of renting equipment. The OPC advised the store that driver's licences contain excessive personal information and have minimal value in theft investigations. As a result of the OPC's involvement, the store discontinued the practice and implemented a less privacy-invasive solution, resolving the complaint to the complainant's satisfaction.

• Appropriateness of collecting driver's licence information for theft prevention.
• Necessity of photocopying driver's licences for equipment rentals.
• Compliance with principles of minimal information collection.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from an employee of the Canada School of Public Service (the School) who alleged his personal information was improperly disclosed. The School had received a letter from the Public Sector Integrity Commissioner (PSIC) identifying seven employees and allegations against them. The School hand-delivered this letter to the named employees, including the complainant. The OPC found that the School's actions contravened the Privacy Act by disclosing the complainant's personal information without authority. Following the OPC's recommendations, the School developed new procedures to protect confidentiality.

• Disclosure of personal information contrary to the Privacy Act
• Adequacy of procedures to protect personal information
• Cooperation with other federal oversight bodies

A staff relations representative complained that the RCMP's disclosure of informal disciplinary records to the Crown was inconsistent with the Supreme Court’s McNeil decision. The complainant argued that only records from formal disciplinary hearings should be disclosed. The OPC agreed with the RCMP that all disciplinary records, informal or formal, may need to be disclosed if relevant to court proceedings. While the complaint was found not well-founded, the OPC recommended the RCMP reconsider its policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services.

• Disclosure of informal disciplinary records to the Crown in light of the McNeil decision
• Relevance determination for disclosure of disciplinary records
• Retention period for RCMP disciplinary records

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint alleging the improper disclosure of personal information on the Canada Border Service Agency's (CBSA) "Wanted by the CBSA" website. While the disclosure itself was found to be permissible under the Privacy Act for immigration law enforcement, the CBSA failed to ensure the accuracy and completeness of the information. The investigation also found the CBSA failed to conduct a Privacy Impact Assessment before launching the program. The CBSA accepted all five OPC recommendations for improvement.

• Whether the CBSA improperly disclosed personal information on its "Wanted by the CBSA" website.
• Whether the CBSA conducted a Privacy Impact Assessment prior to launching the program.
• Whether the CBSA took reasonable steps to ensure the accuracy and completeness of the disclosed personal information.
• Whether the purpose of disclosure was consistent with the Privacy Act.

The complainant settled a legal dispute with a retailer by signing a mutual release, which included releasing the retailer from all past, present, and future claims and complaints. Subsequently, the complainant filed a privacy complaint alleging the retailer failed to provide access to her personal information. The Office of the Privacy Commissioner of Canada (OPC) discontinued the investigation, finding the complaint was made in bad faith because the complainant had already released the retailer from such claims.

• Whether the complaint was made in bad faith
• The effect of a mutual release on a privacy complaint

This investigation concerned a complaint that the Canada Border Services Agency (CBSA) violated the Privacy Act by requiring border services officers (BSOs) to wear name tags displaying their surnames. Complainants argued this was an unreasonable invasion of privacy and exposed them to potential harm. The Office of the Privacy Commissioner of Canada (OPC) found that while the names were personal information, they fell under an exception in the Privacy Act relating to information about an individual's position or functions within a government institution. Therefore, the requirement to display surnames on name tags did not violate the Act.

• Whether displaying surnames on name tags constitutes personal information under the Privacy Act.
• Whether displaying surnames on name tags is an unreasonable invasion of privacy.
• Whether the requirement to display surnames on name tags violates the use and disclosure provisions of the Privacy Act.
• Whether the exception for information relating to an individual's position or functions applies to surnames on name tags.

The Office of the Privacy Commissioner of Canada investigated a complaint regarding the improper disclosure of personal information by Aboriginal Affairs and Northern Development Canada (AANDC). The complainant was concerned that AANDC created a document listing individuals who had requested information about a former minister under the Access to Information Act, and that this document was subsequently disclosed to La Presse newspaper. The investigation found that AANDC improperly shared the document with staff who did not have a need-to-know the identities of the requesters, and that the document was ultimately disclosed to La Presse, violating the Privacy Act.

• Whether the document contained personal information.
• Whether AANDC officials who accessed the document had a need-to-know.
• Whether the disclosure of the document to La Presse constituted a contravention of the Privacy Act.

The complainant alleged that the Public Service Commission of Canada (PSC) contravened the Privacy Act by disclosing her private medical information to multiple witnesses during an investigation into potential fraud. The OPC found that while the PSC's collection and use of the information were justified, the disclosure of the doctor's letter to all witnesses was not a "consistent use" and thus contravened the Act. The PSC has committed to implementing new procedures to ensure future compliance.

• Whether the disclosure of medical information to all witnesses in an investigation complied with the Privacy Act's "consistent use" provision.
• Whether the PSC's disclosure of medical information was necessary for procedural fairness.
• Whether the PSC's interpretation of "affected person" was overly broad, leading to excessive disclosure.

An individual complained that a videographer hired to record her wedding shared her personal information without consent by posting the wedding video online for business promotion. The OPC found that using the video for promotional purposes was a commercial activity requiring consent, which the videographer had not obtained. Although the videographer initially disputed this, they eventually removed the video and agreed to include consent provisions in future contracts, leading to the complaint being resolved.

• Was the use of the wedding video for promotional purposes considered a commercial activity under PIPEDA?
• Did the videographer obtain the complainant's informed consent for the use of her personal information?
• Did any exemptions under PIPEDA apply to the videographer's use of the video without consent?

The complainant alleged that Apple Canada Inc. ("Apple") unnecessarily required payment information and date of birth for downloading a free application. The investigation found that while the date of birth collection was acceptable for authentication, Apple's privacy policy did not fully identify the purposes for its collection. The collection of payment information was also found to be an issue, as Apple did not clearly communicate that it was not required for downloading free applications. Apple agreed to revise its privacy policy and implement recommendations to improve clarity and user experience.

• Identification of purposes for collection of personal information
• Limiting collection of personal information to what is necessary
• Openness about information management policies and practices
• Requirement of payment information for free application downloads

A life insurance company discovered a potential breach of personal information when a new envelope design exposed sensitive data, including SINs, of 53 pension plan members. The company took prompt action by notifying affected individuals, offering credit monitoring services, and implementing new security measures to prevent recurrence. The OPC noted the company's response demonstrated best practices in handling such incidents.

• Potential exposure of sensitive personal information (SIN, date of birth, beneficiary information) due to envelope design.
• Adequacy of the company's response to the potential breach.
• Measures taken to prevent future incidents.

A complainant alleged that the RCMP continued to retain and use personal information from the long-gun registry after it was legally required to be destroyed. The investigation focused on whether the RCMP used this information in contravention of section 7 of the Privacy Act. While the RCMP provided evidence that the registry records were destroyed, the complainant pointed to instances suggesting otherwise. However, the OPC could not find evidence to support the allegation that the RCMP used deleted long-gun registry information and noted that subsequent legislation retroactively exempted certain information from the Privacy Act.

• Whether the RCMP retained and used personal information from the long-gun registry after it was legally required to be destroyed.
• Whether the alleged use of this information contravened section 7 of the Privacy Act.
• The impact of retroactive legislative amendments on the investigation and the application of the Privacy Act.

An individual complained that her bank required her to provide the last six digits of her Social Insurance Number (SIN) to set up a verified credit account for online purchases. The complainant believed this collection was unnecessary and sought an alternative. The bank initially maintained its practice but, after being informed of a similar OPC finding regarding transparency, discontinued the practice and updated its website to remove this authentication method. The complaint was resolved.

• Bank's collection of partial SIN for account verification
• Transparency of alternative authentication methods
• Adequacy of information provided on the bank's website