Canadian privacy & access decisions

An individual complained that Canada Post (CPC) was using personal information gathered from the outside of delivered envelopes and parcels to create mail marketing lists, which it then rented to the private sector. The Office of the Privacy Commissioner (OPC) investigated whether CPC's Smartmail Marketing Program (SMM Program) complied with the Privacy Act. The OPC found that CPC's collection of personal information for the SMM Program was directly related to an operating program (s.4) and that its use and disclosure were for an original purpose of collection (s.7 and s.8), thus compliant with these sections. However, the OPC determined that the SMM Program constituted an "administrative purpose" under the Act, and CPC had failed to obtain individuals' authorization for the indirect collection of their personal information, contravening section 5. CPC disagreed with this finding and refused to implement the OPC's recommendation to cease the practice without authorization, proposing only enhanced transparency measures which the OPC deemed insufficient. Consequently, the complaint was found to be well-founded and not resolved.

• Whether Canada Post's collection of personal information for marketing mail list services complies with section 4 of the Privacy Act (related directly to an operating program or activity).
• Whether Canada Post's use and disclosure of personal information for marketing mail list services complies with sections 7 and 8 of the Privacy Act (for the purpose obtained or consistent use, or with consent).
• Whether Canada Post's collection of personal information for marketing mail list services complies with section 5 of the Privacy Act (direct collection for administrative purpose, or with authorization).
• Whether the use of an individual's information to provide mail marketing services constitutes an "administrative purpose" under section 3 of the Privacy Act.
• Whether individuals implicitly authorized Canada Post to indirectly collect their personal information for the SMM Program by accepting mail delivery or through the availability of an opt-out mechanism.
• Whether the exceptions under subsection 5(3) of the Privacy Act apply.

The complainant alleged that Fisheries and Oceans Canada (DFO) improperly withheld information under subsections 19(1), 20(1)(a), 20(1)(b), and 20(1)(c) of the Access to Information Act in response to a request for correspondence between DFO and Deep Water Recovery. During the investigation, the application of subsection 19(1) was removed from the scope of the complaint, and both DFO and the third party conceded that paragraphs 20(1)(a) and 20(1)(c) should not have been applied. The investigation therefore focused on paragraph 20(1)(b). The Commissioner found that neither DFO nor Deep Water Recovery demonstrated that the information met all the requirements for confidentiality under paragraph 20(1)(b), specifically that the information was not publicly available and that there was a reasonable expectation of confidentiality. Consequently, the Commissioner concluded that the information did not meet the requirements of paragraph 20(1)(b). The complaint was found to be well founded, and DFO was ordered to disclose the information.

• Whether s.19(1) personal information exemption was properly applied
• Whether s.20(1)(a) third-party trade secrets exemption was properly applied
• Whether s.20(1)(b) confidential third-party financial, commercial, scientific or technical information exemption was properly applied
• Whether s.20(1)(c) financial impact on a third party exemption was properly applied
• Whether the information is financial, commercial, scientific or technical under s.20(1)(b)
• Whether the information is confidential under s.20(1)(b)
• Whether the information was supplied by a third party under s.20(1)(b)
• Whether the third party consistently treated the information as confidential under s.20(1)(b)
• Whether the information was available from sources otherwise accessible by the public (confidentiality criterion)
• Whether the information was communicated with a reasonable expectation that it would not be disclosed (confidentiality criterion)
• Whether the information was communicated in a relationship fostered for public benefit by its confidentiality (confidentiality criterion)
• Whether the OIC's notice to third parties under s.36.3 breached natural justice and procedural fairness

The complainant alleged that Immigration, Refugees and Citizenship Canada (IRCC) inappropriately disclosed his Permanent Resident Card (PRC) renewal paperwork to the Canada Border Services Agency (CBSA), which was then used in a cessation application, contrary to the purpose for which it was collected. The OPC investigated whether IRCC was authorized to disclose this personal information to the CBSA under paragraph 8(2)(a) of the Privacy Act, which permits disclosure for a consistent use. IRCC and CBSA argued that their information sharing for the administration and enforcement of the Immigration and Refugee Protection Act (IRPA) constitutes a consistent use. The OPC found that the privacy notice on the PRC renewal application and the relevant Personal Information Bank (PIB) explicitly stated that information might be shared with CBSA for investigations related to immigration legislation. Therefore, the OPC concluded that the disclosure was for a consistent use, and the complaints against both departments were not well-founded.

• Whether IRCC's disclosure of the complainant's personal information to CBSA was authorized under paragraph 8(2)(a) of the Privacy Act
• Whether the use of the personal information by CBSA in a cessation application was consistent with the purpose for which it was collected by IRCC
• Whether the complainant could reasonably expect the disclosure of his PRC renewal application to CBSA for immigration investigations