Canadian privacy & access decisions

A student complained that a property management firm required his Social Insurance Number (SIN) to rent an apartment. The firm stated it needed the SIN for identity verification, credit checks, and collections. The OPC noted that while no legislation prevents organizations from asking for SINs for identification, organizations subject to PIPEDA must inform individuals that providing a SIN for identification is optional and not a condition of service. As a result of the complaint, the property manager revised the lease agreement to only require a driver's license for identification and stopped requesting SINs from potential renters. The student and the OPC considered the matter settled.

• Whether requiring a SIN for an apartment lease is permissible under PIPEDA
• Whether organizations must inform individuals that providing a SIN for identification is optional

An individual complained that a restaurant's credit card receipts displayed her name, full credit card number, and expiry date, arguing this information should be masked. The restaurant used electronic processing equipment that did not mask this information. The OPC found that the personal information was collected, used, and stored in a manner consistent with PIPEDA principles, and there was no unauthorized disclosure. However, the OPC noted that technology for masking credit card information on receipts exists and that industry representatives indicated all equipment would mask this information by 2007. The complainant was satisfied with this information and the restaurant owner's awareness of privacy legislation. The matter was settled during the investigation.

• Whether the display of full credit card details on receipts constituted a contravention of PIPEDA
• Whether the collection, use, and storage of personal information on credit card receipts was consistent with PIPEDA principles
• Whether there was unauthorized disclosure of personal information