Canadian privacy & access decisions

An individual complained that his former employer, an interprovincial trucking company, disclosed his personal information to a creditor without his consent. The investigation found no evidence to support this allegation; in fact, the complainant had provided some of the information to the creditor himself. During the investigation, the trucking company, a small family-owned business, developed and implemented a written privacy policy, appointed an Information Officer, and reviewed its practices regarding employee information. The company also took steps to ensure its employees were aware of fair information handling practices. Both the complainant and the OPC were satisfied with these actions, and the matter was settled.

• Whether the trucking company disclosed the complainant's personal information to a creditor without consent

An individual complained that an insurance company required overly broad consent for the collection, use, and disclosure of personal information when applying for life insurance. The OPC found the company's actual practices were compliant with PIPEDA. However, the company acknowledged the complainant's concerns about the clarity and precision of its consent language. The company agreed to revise its consent forms and share the updated language with the complainant for feedback. The complainant was satisfied with the company's explanation and its commitment to review the consent language. The complaint was settled during the investigation.

• Whether the insurance company's consent language was overly broad
• Whether the insurance company's collection, use, and disclosure practices were consistent with PIPEDA

A complainant's laptop, returned for repair, was sold by a retail store with her personal information still on it. The individual who purchased the laptop contacted the complainant, raising concerns about the store's safeguards. The investigation revealed an employee sold the returned laptop without wiping its data. The company retrieved the laptop and returned it to the complainant. In response, the store implemented new procedures to ensure all customer data is wiped from returned electronic devices, with documentation required for these actions. The complainant was satisfied with these changes, and the complaint was settled.

• Whether the retail store adequately safeguarded the complainant's personal information on a returned laptop
• Whether the retail store's practices led to an unauthorized disclosure of personal information

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without consent. The OPC's investigation found merit in the complaint. The lending institution agreed to apologize to the complainant and adjust her outstanding loan. Furthermore, the OPC noted the institution lacked privacy policies and practices. The institution committed to implementing privacy policies, establishing a privacy committee, providing employee training, and reminding staff about limiting information disclosure during debt recovery. Both the complainant and the OPC were satisfied with these actions.

• Whether the lending institution disclosed personal information without consent
• Whether the lending institution had adequate privacy policies and practices in place

A former employee complained that his previous employer, a trucking company, disclosed his personal information to other trucking firms after his employment ended. While the original complaint focused on the disclosure, the Office of the Privacy Commissioner (OPC) also identified the absence of a company privacy policy and a designated privacy representative as issues. Through discussions, both parties reached a settlement. The trucking company agreed to develop privacy policies and procedures, which it subsequently provided to the OPC, and also appointed a privacy officer. The complaint was settled during the investigation.

• Whether a trucking company disclosed personal information about a former employee to other firms without authorization
• Whether the trucking company had adequate privacy policies and procedures in place
• Whether the trucking company had a designated privacy officer

A doctor complained that a professional organization ignored his request for access to his personal information. The complainant believed he was the subject of a planned conference talk by a member of the organization and sought access to information related to this presentation. The OPC confirmed that the organization had not acted on the access request. However, the OPC also found that the presentation was never given, and therefore the organization held no personal information about the doctor. The complainant was satisfied with this explanation and withdrew his complaint.

• Whether the professional organization failed to respond to an access request
• Whether the professional organization held personal information about the complainant