Canadian privacy & access decisions

An individual complained that an online dating service continued to send him marketing emails after he cancelled his membership and requested his information be deleted. He also alleged the service denied him access to his personal information. During the investigation, the dating service was sold, and the new owner inherited the customer database. The OPC found the original service violated PIPEDA by denying access, retaining information longer than necessary, continuing to use his email for marketing after consent withdrawal, lacking a privacy policy, and failing to safeguard information. While some issues were resolved by the new owner, the denial of access and destruction of photographs during an access request were found to be well-founded and unresolved.

• Whether the organization denied the complainant access to his personal information in violation of Principle 4.9
• Whether the organization failed to respect the 30-day time limit for access requests under subsection 8(3)
• Whether the organization contravened subsection 8(8) by destroying photographs, limiting the complainant's recourse
• Whether the organization retained the complainant's information longer than necessary in contravention of Principle 4.5.3
• Whether the organization continued to use the complainant's personal information for marketing after consent withdrawal, contravening Principle 4.3.8
• Whether the organization lacked a privacy policy in contravention of Principle 4.1.4(d)
• Whether the organization failed to safeguard the complainant's personal information as required by Principle 4.7.1