Canadian privacy & access decisions

An individual complained after receiving promotional material and telemarketing calls following her application for a department store credit card, believing she had not consented to the use of her contact information for marketing. The department store asserted that her signature on the application form indicated agreement to its terms and conditions, which included marketing. The OPC found that the application form adequately explained how personal information would be used and provided an opt-out mechanism below the signature line. The OPC informed the complainant that this type of opt-out was permissible under PIPEDA. The complainant was satisfied with this explanation and requested removal from marketing lists, which the store completed. The complaint was settled during the investigation.

• Whether the department store obtained valid consent for using personal information for marketing purposes
• Whether the opt-out mechanism provided by the department store was compliant with PIPEDA

An individual complained that a business withheld some of his personal information and its privacy policy. The business initially claimed the individual was not entitled to information predating January 1, 2004, when PIPEDA became applicable to it. After the complainant challenged this, the business provided the remaining personal information but still did not provide a privacy policy. The OPC discovered the business did not have a privacy policy. At the OPC's request, the business drafted a privacy policy and provided it to the complainant. The complainant considered the matter settled.

• Whether the business improperly withheld personal information requested by the individual
• Whether the business failed to make its privacy policy publicly available as required by PIPEDA

An individual complained that a condominium corporation disclosed personal information about her dispute with the corporation to all condominium owners. The corporation sent a letter detailing the alleged by-law contravention to all owners, posted it on a bulletin board, and included it in Board meeting minutes. The corporation initially believed only contact information, which it considered publicly available, was disclosed. However, the OPC clarified that the personal information at issue was the fact of the dispute itself. The corporation had disclosed this information without the complainant's consent. The matter was resolved when the condominium corporation sent the complainant a letter of apology.

• Whether the fact of an individual's dispute with a condominium corporation constitutes personal information under PIPEDA
• Whether the condominium corporation disclosed personal information without consent
• Whether the personal information was publicly available