Canadian privacy & access decisions

An individual complained that a department store disclosed his personal information to a third party, a credit monitoring service, after he had requested that his information not be shared. The complainant received a mail solicitation that appeared to be supported by the department store but sent by the third party. The investigation found that the department store had not disclosed the complainant's personal information; rather, the store conducted the mail-out on behalf of the third party. The store acknowledged that the mail-out should have been clearer about its role and apologized. The store also agreed to review its account application policies to allow new customers to opt out at enrolment and to improve its suppression mechanisms. The complaint was settled during the investigation.

• Whether the department store disclosed personal information to a third party without consent
• Whether the mail-out clearly indicated the department store's role
• Whether the department store's opt-out mechanisms were adequate