Canadian privacy & access decisions

An imposter gained access to the complainant's cell phone account by social engineering a customer service representative (CSR). The CSR disclosed personal information, including PIN, billing, and call history, and made changes to the account. The complainant also alleged inadequate response to an access request for call recordings and transcripts. The OPC found the disclosure of personal information to the imposter to be well-founded, as the company's authentication procedures were not followed, contravening Principle 4.3. The access complaint was found well-founded because the company initially failed to respond within the 30-day timeframe, but it was resolved as the company eventually provided the requested information. The OPC recommended the company review its privacy management programs, policies, and procedures.

• Whether the cellular service provider disclosed personal information without consent to an imposter, contravening Principle 4.3 PIPEDA
• Whether the cellular service provider adequately responded to the complainant's access request for personal information under Principle 4.9 PIPEDA
• Whether the cellular service provider responded to the access request within the 30-day timeframe as per s.8(3) PIPEDA
• Whether the redaction of the CSR's name from the transcript was permissible under s.9(1) PIPEDA
• Whether the company was required to provide an audio recording of the conversation in addition to a transcript under s.10 PIPEDA

A complainant alleged that a telecommunications firm failed to provide her with access to her personal information, specifically notes and transcripts of recorded conversations related to an account dispute. The firm acknowledged receiving the access request but mistakenly believed it was not necessary to provide the information due to ongoing settlement negotiations. The OPC found that the firm failed to respond to the access request within 30 days and did not issue an extension notice, thus contravening PIPEDA subsections 8(3), 8(4), and 8(5). Furthermore, the firm purged the requested audio records, violating subsection 8(8) and Principles 4.9 and 4.9.4. The firm's internal policies were found to be unclear and staff training inadequate, leading to the erroneous deletion of records. The OPC made several recommendations, which the firm accepted and implemented, including amending policies and providing staff training. As a result, the complaint was deemed well-founded and resolved.

• Whether the telecommunications firm responded to the access request within the 30-day time limit under subsection 8(3) PIPEDA
• Whether the telecommunications firm issued a notice of extension for the access request under subsection 8(4) PIPEDA
• Whether the telecommunications firm was deemed to have refused the access request under subsection 8(5) PIPEDA
• Whether the telecommunications firm provided access to personal information as required by Principle 4.9 PIPEDA
• Whether the telecommunications firm responded to the access request within a reasonable time and at minimal or no cost under Principle 4.9.4 PIPEDA
• Whether the telecommunications firm retained personal information that was the subject of an access request for as long as necessary to allow the individual to exhaust any recourse under subsection 8(8) PIPEDA
• Whether the telecommunications firm implemented policies and practices to give effect to the principles, including training staff and communicating policies and practices under Principle 4.1.4(c) PIPEDA