Canadian privacy & access decisions

An imposter gained access to the complainant's cell phone account by social engineering a customer service representative (CSR). The CSR disclosed personal information, including PIN, billing, and call history, and made changes to the account. The complainant also alleged inadequate response to an access request for call recordings and transcripts. The OPC found the disclosure of personal information to the imposter to be well-founded, as the company's authentication procedures were not followed, contravening Principle 4.3. The access complaint was found well-founded because the company initially failed to respond within the 30-day timeframe, but it was resolved as the company eventually provided the requested information. The OPC recommended the company review its privacy management programs, policies, and procedures.

• Whether the cellular service provider disclosed personal information without consent to an imposter, contravening Principle 4.3 PIPEDA
• Whether the cellular service provider adequately responded to the complainant's access request for personal information under Principle 4.9 PIPEDA
• Whether the cellular service provider responded to the access request within the 30-day timeframe as per s.8(3) PIPEDA
• Whether the redaction of the CSR's name from the transcript was permissible under s.9(1) PIPEDA
• Whether the company was required to provide an audio recording of the conversation in addition to a transcript under s.10 PIPEDA