Canadian Privacy Decisions

This investigation examined Desjardins' compliance with PIPEDA following a significant data breach that occurred between 2017 and 2019, affecting nearly 9.7 million individuals. The Office of the Privacy Commissioner of Canada (OPC) found that Desjardins contravened PIPEDA principles regarding accountability, data retention, and security safeguards. While Desjardins' mitigation measures for affected individuals were deemed adequate, the OPC issued recommendations to address the identified contraventions.

• Adequacy of security safeguards throughout the personal information lifecycle.
• Compliance with accountability principles, including implementing procedures and training staff.
• Appropriateness of data retention and destruction practices.
• Effectiveness of mitigation measures offered to individuals affected by the breach.

This report details a review of passport protection practices by four federal institutions: IRCC, ESDC, GAC, and CPC. While the institutions generally had reasonable measures to prevent unauthorized passport disclosures, the review identified areas for improvement in incident detection, remediation for affected individuals, and learning from past breaches. The institutions agreed to implement the OPC's recommendations to enhance these processes.

• Adequacy of measures to prevent unauthorized disclosure of passports
• Effectiveness of incident detection mechanisms
• Sufficiency of remediation measures for affected individuals
• Processes for learning from past passport breach incidents

This report details a systemic investigation into how the Department of National Defence (DND) processed access to information requests between January 1, 2017, and December 21, 2018. The investigation examined six key offices and DND's ATIP Directorate, reviewing their internal processes, training, and statistics. The Commissioner made nine recommendations to the Minister of National Defence to address identified shortcomings, which the Minister accepted and agreed to implement.

• Timeliness of access to information request processing
• Adherence to legislative obligations under the Access to Information Act
• Effectiveness of internal procedures and training for ATIP staff
• Improvement of ATIP compliance metrics