Canadian privacy & access decisions

An individual complained that a department store disclosed his personal information to a third party, a credit monitoring service, after he had requested that his information not be shared. The complainant received a mail solicitation that appeared to be supported by the department store but sent by the third party. The investigation found that the department store had not disclosed the complainant's personal information; rather, the store conducted the mail-out on behalf of the third party. The store acknowledged that the mail-out should have been clearer about its role and apologized. The store also agreed to review its account application policies to allow new customers to opt out at enrolment and to improve its suppression mechanisms. The complaint was settled during the investigation.

• Whether the department store disclosed personal information to a third party without consent
• Whether the mail-out clearly indicated the department store's role
• Whether the department store's opt-out mechanisms were adequate

An individual complained to the OPC after a collection agency failed to correct inaccurate information in his credit file, despite his lawyer's repeated attempts. The complainant had paid off a debt years prior, but the collection agency had not reported this to credit bureaux, causing him difficulty in securing credit. The collection agency initially had no record of the lawyer's correspondence. However, after the OPC intervened and the lawyer sent another letter, the agency investigated and confirmed the debt was paid. Consequently, the agency updated the credit bureaux, and the complainant's credit files were amended. The complaint was settled during the investigation.

• Whether the collection agency failed to ensure the accuracy of personal information it held
• Whether the collection agency failed to correct inaccurate personal information upon request

Several employees of a federally regulated transportation company complained that a list of employees receiving severance packages, including names, identification and seniority numbers, and Social Insurance Numbers (SINs), was disclosed to their union without their knowledge or consent. The company admitted that the SINs were included on an electronic spreadsheet provided to the union, though in a hidden column. The employer did not obtain employee consent for this disclosure. During the investigation, the company changed its severance application process to no longer require SINs. The company also agreed to amend its application form to include a consent statement for the release of personal information to the union. The complaint was settled during the investigation.

• Whether the disclosure of employee names, identification numbers, seniority numbers, and Social Insurance Numbers to a union without consent contravened PIPEDA