Canadian Privacy Decisions

This report details an investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants. The investigation found that both Employment and Social Development Canada (ESDC) and Justice Canada failed to adequately translate their privacy and security policies into practice, leading to weaknesses in physical, technological, administrative, and personnel controls. Both departments accepted nine recommendations to improve data protection, many of which were similar to those made in a previous investigation involving ESDC.

• Adequacy of physical, technological, administrative, and personnel security controls
• Failure to translate privacy and security policies into meaningful business practices
• Protection of sensitive personal information including SIN and medical details
• Custody and storage of portable electronic devices containing personal information

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from an employee of the Canada School of Public Service (the School) who alleged his personal information was improperly disclosed. The School had received a letter from the Public Sector Integrity Commissioner (PSIC) identifying seven employees and allegations against them. The School hand-delivered this letter to the named employees, including the complainant. The OPC found that the School's actions contravened the Privacy Act by disclosing the complainant's personal information without authority. Following the OPC's recommendations, the School developed new procedures to protect confidentiality.

• Disclosure of personal information contrary to the Privacy Act
• Adequacy of procedures to protect personal information
• Cooperation with other federal oversight bodies

A staff relations representative complained that the RCMP's disclosure of informal disciplinary records to the Crown was inconsistent with the Supreme Court’s McNeil decision. The complainant argued that only records from formal disciplinary hearings should be disclosed. The OPC agreed with the RCMP that all disciplinary records, informal or formal, may need to be disclosed if relevant to court proceedings. While the complaint was found not well-founded, the OPC recommended the RCMP reconsider its policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services.

• Disclosure of informal disciplinary records to the Crown in light of the McNeil decision
• Relevance determination for disclosure of disciplinary records
• Retention period for RCMP disciplinary records

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint alleging the improper disclosure of personal information on the Canada Border Service Agency's (CBSA) "Wanted by the CBSA" website. While the disclosure itself was found to be permissible under the Privacy Act for immigration law enforcement, the CBSA failed to ensure the accuracy and completeness of the information. The investigation also found the CBSA failed to conduct a Privacy Impact Assessment before launching the program. The CBSA accepted all five OPC recommendations for improvement.

• Whether the CBSA improperly disclosed personal information on its "Wanted by the CBSA" website.
• Whether the CBSA conducted a Privacy Impact Assessment prior to launching the program.
• Whether the CBSA took reasonable steps to ensure the accuracy and completeness of the disclosed personal information.
• Whether the purpose of disclosure was consistent with the Privacy Act.

A woman received the personal information of five strangers along with her daughter's tax documents from the Canada Revenue Agency (CRA). She attempted to return the information to the CRA through various channels but faced difficulties. The OPC launched a Commissioner-initiated investigation, which concluded that the CRA had breached the privacy rights of the individuals whose information was improperly disclosed. The CRA has since implemented remedial measures to improve its procedures for handling misdirected mail and facilitating breach reporting.

• Adequacy of CRA's procedures for handling misdirected personal information.
• Effectiveness of CRA's channels for the public to report privacy breaches.
• Timeliness and appropriateness of CRA's response to the breach.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint regarding an equipment store's policy of photocopying customers' driver's licences as a condition of renting equipment. The OPC advised the store that driver's licences contain excessive personal information and have minimal value in theft investigations. As a result of the OPC's involvement, the store discontinued the practice and implemented a less privacy-invasive solution, resolving the complaint to the complainant's satisfaction.

• Appropriateness of collecting driver's licence information for theft prevention.
• Necessity of photocopying driver's licences for equipment rentals.
• Compliance with principles of minimal information collection.