Canadian privacy & access decisions

The OPC initiated a complaint against Compu-Finder (3510395 Canada Inc.) for allegedly collecting and using individuals' email addresses without consent to send promotional emails. Compu-Finder argued it had implied consent, that the information was publicly available, or that it fell under the business contact information carve-out. The OPC found that Compu-Finder contravened PIPEDA principles regarding meaningful consent, fair and lawful collection, accountability, and openness. Specifically, its telemarketing script was inadequate, and it failed to prove express consent or justify implied consent or exemptions. Compu-Finder also lacked a designated privacy officer and public privacy policies. As a result, the OPC issued recommendations, which Compu-Finder agreed to implement. The OPC concluded the complaint was well-founded and resolved in part, and well-founded and conditionally resolved in part, entering into a compliance agreement to monitor implementation.

• Whether Compu-Finder's collection and use of email addresses constituted "personal information" under PIPEDA.
• Whether the business contact information carve-out under s. 4.01 PIPEDA applied to Compu-Finder's activities.
• Whether Compu-Finder obtained meaningful express consent for collecting email addresses via telemarketing (Principles 4.2, 4.3, 4.3.2).
• Whether Compu-Finder collected personal information by fair and lawful means (Principle 4.4).
• Whether Compu-Finder obtained meaningful implied consent for collecting email addresses from publicly available sources (Principle 4.3.6).
• Whether the "publicly available information" exemption (s. 7(1)(d), 7(2)(c.1) PIPEDA and s. 1 of the Regulations) applied to Compu-Finder's collection and use of email addresses.
• Whether the address harvesting provisions (s. 7.1(2) PIPEDA) prohibited the use of email addresses collected via software before the provision came into force.
• Whether Compu-Finder had a designated individual accountable for PIPEDA compliance (Principle 4.1).
• Whether Compu-Finder implemented policies and practices to give effect to PIPEDA principles (Principle 4.1.4).
• Whether Compu-Finder was open about its personal information management policies and practices (Principles 4.8.1, 4.8.2).