Canadian privacy & access decisions

Several employees of a federally regulated transportation company complained that a list of employees receiving severance packages, including names, identification and seniority numbers, and Social Insurance Numbers (SINs), was disclosed to their union without their knowledge or consent. The company admitted that the SINs were included on an electronic spreadsheet provided to the union, though in a hidden column. The employer did not obtain employee consent for this disclosure. During the investigation, the company changed its severance application process to no longer require SINs. The company also agreed to amend its application form to include a consent statement for the release of personal information to the union. The complaint was settled during the investigation.

• Whether the disclosure of employee names, identification numbers, seniority numbers, and Social Insurance Numbers to a union without consent contravened PIPEDA

An individual complained that a bank inappropriately required a credit check and other personal information, including length of employment and Social Insurance Number (SIN), to open a no-fee personal deposit account online. The complainant also found the language regarding information exchange with credit bureaus unclear. The bank agreed to modify its online application forms to clarify that credit checks are optional for deposit accounts if applied for in person. It also agreed to only request length of employment for credit applications and make SIN provision optional. The bank committed to reviewing the language concerning credit bureau information exchange. The OPC confirmed the complainant's credit rating was unaffected. Both the complainant and the OPC were satisfied with the bank's actions.

• Whether a credit check was appropriately required for a no-fee personal deposit account
• Whether length of employment was appropriately required for a no-fee personal deposit account
• Whether the Social Insurance Number (SIN) was appropriately required for a no-fee personal deposit account
• Whether the language describing information exchange with credit bureaus was clear

An individual complained that a pharmacy chain required him to sign an overly broad consent form for medication, fearing his personal information would be used for marketing. The complainant was concerned he would be denied medication if he refused consent. The OPC clarified with the pharmacy that it did not disclose personal information for secondary marketing purposes. The pharmacy, having received similar complaints, revised its consent form to be simpler and clearer. It also introduced a new policy allowing customers to verbally consent to privacy practices if they were uncomfortable signing the form. The complainant was satisfied with these changes.

• Whether the pharmacy's consent form authorized overly broad disclosure practices
• Whether personal information was being disclosed for marketing purposes
• Whether the pharmacy's consent process was appropriate under PIPEDA