Canadian Privacy Decisions

A complainant alleged that his Internet Service Provider (ISP) disclosed his personal information without consent to a newspaper columnist who was assisting him with a service dispute. The ISP argued it had implied consent due to the complainant's actions. The OPC found that the complainant's familiarity with the columnist and his own disclosure of information in his email to the columnist created a reasonable expectation that his information might be shared to resolve the dispute. The disclosed information was also found to be relevant and not sensitive.

• Was there implied consent for the disclosure of personal information to a columnist assisting with a dispute?
• Was the disclosed information relevant to the complaint?
• Was the disclosed information sensitive?

The complainant alleged that his employer disclosed detailed personal information about his absence from the workplace to other employees. The organization used an electronic scheduling program that allowed all employees to view the reasons for colleagues' absences. The OPC found that this disclosure constituted a contravention of PIPEDA, as the organization's purposes were not appropriate and less privacy-intrusive means were available to manage employee schedules and shift exchanges. The organization committed to removing the detailed leave information from its systems.

• Appropriate purposes for disclosure of personal information
• Balancing employee privacy with operational needs
• Necessity of disclosing reasons for absence
• Interpretation of collective agreement obligations

A staff relations representative complained that the RCMP's disclosure of informal disciplinary records to the Crown was inconsistent with the Supreme Court’s McNeil decision. The complainant argued that only records from formal disciplinary hearings should be disclosed. The OPC agreed with the RCMP that all disciplinary records, informal or formal, may need to be disclosed if relevant to court proceedings. While the complaint was found not well-founded, the OPC recommended the RCMP reconsider its policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services.

• Disclosure of informal disciplinary records to the Crown in light of the McNeil decision
• Relevance determination for disclosure of disciplinary records
• Retention period for RCMP disciplinary records

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding an equipment store's policy of photocopying customers' driver's licences as a condition of renting equipment. The OPC advised the store that driver's licences contain excessive personal information and have minimal value in theft investigations. As a result of the OPC's involvement, the store discontinued the practice and implemented a less privacy-invasive solution, resolving the complaint to the complainant's satisfaction.

• Appropriateness of collecting driver's licence information for theft prevention.
• Necessity of photocopying driver's licences for equipment rentals.
• Compliance with principles of minimal information collection.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from an employee of the Canada School of Public Service (the School) who alleged his personal information was improperly disclosed. The School had received a letter from the Public Sector Integrity Commissioner (PSIC) identifying seven employees and allegations against them. The School hand-delivered this letter to the named employees, including the complainant. The OPC found that the School's actions contravened the Privacy Act by disclosing the complainant's personal information without authority. Following the OPC's recommendations, the School developed new procedures to protect confidentiality.

• Disclosure of personal information contrary to the Privacy Act
• Adequacy of procedures to protect personal information
• Cooperation with other federal oversight bodies