Canadian privacy & access decisions

An individual complained that a collection agency was pursuing him for a debt he did not owe, which was negatively impacting his credit report. The individual alleged that the agency had been calling him for years and disclosed his financial information to his household members. He also claimed he was denied access to documentation validating the debt. The OPC contacted the collection agency, which then investigated the matter after discrepancies were noted in the original credit application. The agency ceased debt collection, acknowledged possible fraud, and committed to correcting the individual's credit report. The individual was satisfied with this resolution.

• Whether the collection agency ensured the accuracy of personal information used for debt collection (Principle 4.5 PIPEDA)
• Whether the collection agency provided the individual with access to his personal information (Principle 4.9 PIPEDA)
• Whether the collection agency disclosed personal financial information to third parties without consent (Principle 4.3 PIPEDA)

The complainant, an RCMP employee, alleged that the RCMP inappropriately used employees' personal information during a training course for Respectful Workplace Advisors on the National Administrative Records Management System (NARMS). During a data entry exercise, participants were given sheets containing real personal information of 91 employees, including names, ranks, and incident descriptions. The complainant raised concerns as participants were not advised real data would be used nor required to sign confidentiality agreements. The RCMP acknowledged that the use of this personal information for training purposes was not authorized under section 7 of the Privacy Act, as training was not a consistent use described in the applicable Personal Information Bank. The RCMP subsequently notified all 91 affected employees of the breach and took steps to prevent future occurrences. The OPC found the complaint to be well-founded.

• Whether the use of employees' personal information for training purposes constituted an unauthorized use under section 7(a) of the Privacy Act
• Whether training was a consistent use of personal information as described in the applicable Personal Information Bank (PIB PSU 915)