Canadian privacy & access decisions

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, and disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers of these practices or provide an easy opt-out mechanism. The investigation found that while the company had a privacy policy available online and in booklets, it did not actively bring these practices to the attention of new customers during the service application process. The Assistant Commissioner determined that the company's practices did not meet the reasonable expectations of its customers and thus contravened several PIPEDA principles. The complaint was found to be well-founded, and the Assistant Commissioner recommended that the company draw customers' attention to its privacy policy and options at the time of collection.

• Whether the telecommunications company obtained adequate knowledge and consent for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection under Principle 4.2.3
• Whether the company made reasonable efforts to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the company's consent practices met the reasonable expectations of the individual under Principle 4.3.5

An individual complained that a telecommunications company failed to obtain proper consent for the collection, use, or disclosure of personal information for secondary marketing purposes. The complainant alleged that the company did not adequately inform customers about its practice of sharing data with affiliates for marketing, failed to provide clear information on potential secondary uses, and did not offer an easy opt-out mechanism. The company maintained that its privacy policy, code, and activation process provided a sufficient basis for customer knowledge and consent, and that it complied with CRTC restrictions on disclosing personal information. The investigation found that the company's privacy documents and activation process constituted a reasonable effort to advise individuals of secondary purposes and that customers could refuse or withdraw consent. The Assistant Commissioner concluded that the company was in compliance with PIPEDA.

• Whether the telecommunications company obtained adequate knowledge and consent for the collection, use, or disclosure of personal information for secondary marketing purposes under Principle 4.3
• Whether the company specified identified purposes at or before the time of collection as per Principle 4.2.3
• Whether the company made a reasonable effort to ensure individuals were advised of the purposes for which information would be used, as required by Principle 4.3.2
• Whether the form of consent sought by the organization was appropriate given the circumstances and type of information, considering Principle 4.3.4
• Whether the reasonable expectations of the individual were considered in obtaining consent, as per Principle 4.3.5