Canadian Privacy Decisions

An individual complained that Veterans Affairs improperly collected his personal information by searching for and disclosing a URL linking to a Google group discussion page containing his email address and personal opinions. The OPC found that while the information was publicly available, its collection by Veterans Affairs did not relate directly to an operating program or activity of the institution, violating the Privacy Act. The complaint was well-founded, and Veterans Affairs apologized and deleted the email.

• Whether the collection of a URL linking to publicly available personal information relates directly to an operating program or activity of a federal institution.
• The distinction between the use/disclosure of publicly available information and its collection under the Privacy Act.

A complainant challenged Canada Post's practice of checking credit information during an online change of address request, alleging a violation of the Privacy Act. The OPC investigated and found that while Canada Post uses Equifax for identity verification, it does not conduct a credit check. Although no contravention of the Act was found regarding the information sharing itself, the OPC recommended and Canada Post implemented clearer notifications to individuals about the sharing of their personal information with Equifax for identity verification purposes.

• Whether Canada Post contravened the Privacy Act by sharing personal information with Equifax for identity verification.
• Adequacy of notice provided to individuals regarding the disclosure of personal information to Equifax.
• Canada Post's statutory authority to collect personal information for the online change of address process.

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint from a woman who alleged her personal information regarding a drug scan during a prison visit was inappropriately disclosed. The OPC found that the Correctional Service of Canada (CSC) failed to adequately investigate the disclosure, which resulted in the woman's ex-husband restricting access to their children. The OPC determined that CSC employees had disclosed the information, but could not identify the source or specific individuals involved. The complaint was upheld as well-founded due to the improper disclosure and CSC's inadequate handling of the issue.

• Inappropriate disclosure of personal information
• Adequacy of investigation into the disclosure
• Responsibility of the institution for unauthorized access and disclosure

A Canadian woman complained that her personal information, including her Social Insurance Number and tax assessment, was disclosed to a foreign national without her consent when he applied for a work permit. The information was sent by her MP to the Canadian High Commission in Dhaka. The High Commission returned all documents, including the woman's, to the applicant, who then allegedly shared them with others. The Office of the Privacy Commissioner of Canada found the complaint well-founded, noting that Citizenship and Immigration Canada acknowledged the lack of consent and that the disclosure should not have occurred.

• Disclosure of personal information without consent
• Adequacy of safeguards to prevent unauthorized disclosure
• Jurisdiction over foreign missions