Canadian privacy & access decisions

A complainant sought to open an online financial investment account with a FinTech organization. To access the investment account management agreement, the complainant was required to provide personal information, some of which was sensitive. After reviewing the agreement, the complainant decided not to open an account and requested deletion of their personal information. The organization cited "regulatory requirements" for the collection. The OPC clarified that while regulatory requirements exist, they apply once an individual becomes a client, not before. The OPC advised the organization to revise its website so prospective clients could review the agreement without prior personal information disclosure. The organization agreed to revise its website and Privacy Policy, leading to an early resolution.

• Whether a FinTech organization can require personal information before a prospective client reviews terms and conditions
• Whether consent under PIPEDA is meaningful if personal information is collected before a user can review service agreements
• Whether regulatory requirements justify collecting personal information from prospective clients who do not proceed with opening an account

The Office of the Privacy Commissioner of Canada (OPC) investigated a complaint against the Privy Council Office (PCO) regarding its MyDemocracy.ca website. The complainant alleged that the website used "Facebook Connect" tracking, sharing user data with Facebook despite promises of anonymity. The OPC found that the website's design facilitated the disclosure of personal information, including IP addresses, browser characteristics, and for logged-in users, Facebook IDs, to Facebook upon loading the homepage and initiating share actions, without obtaining consent. PCO argued that the design was standard and that the shared data did not constitute identifiable personal information. However, the OPC concluded that this constituted a disclosure of personal information under section 3 of the Privacy Act and that PCO failed to meet its obligations under section 8. The complaint was found to be well-founded, and the OPC reiterated recommendations for PCO to ensure privacy-sensitive design, conduct PIAs, and obtain meaningful consent for future initiatives.

• Whether the MyDemocracy.ca website's design led to the disclosure of personal information to third parties (Facebook, Google Analytics) without consent.
• Whether IP addresses, browser characteristics, and unique URLs constitute "personal information" under section 3 of the Privacy Act.
• Whether the Privy Council Office (PCO) met its obligations under section 8 of the Privacy Act regarding the disclosure of personal information.
• Whether PCO's amendments to the website and privacy policy were sufficient to obtain meaningful consent for data disclosure.
• Whether PCO should have conducted a Privacy Impact Assessment (PIA) for the MyDemocracy.ca initiative.
• Whether the collection of demographic information was justified and compliant with relevant standards.
• Whether the use of Google Analytics complied with the Treasury Board of Canada Secretariat's (TBS) Standard on Privacy and Web Analytics.