Canadian Privacy Decisions

An individual complained that a loyalty program had provided his children's names and addresses to its partner credit card companies, resulting in the children receiving unsolicited marketing materials. The issue arose because the loyalty program did not record the dates of birth for its minor members, meaning they were not identified as minors in its system. Although the program updated the children's profiles and removed their information from the system, ongoing marketing mailings persisted for a period due to advance list generation.

• Disclosure of children's personal information to third parties for marketing purposes.
• Failure to identify and protect the personal information of minors.
• Unreasonable delay in resolving the issue and stopping marketing mailings.

An individual complained that a web-based company retained his personal information for too long after cancelling his free trial membership. The complainant also alleged the company lacked accountability as it did not answer all his privacy questions and had no designated privacy officer. As a result of the complaint, the company revised its privacy policy to clarify retention periods and purposes, and designated a privacy officer. The complainant was satisfied with these changes, and the complaint was settled.

• Excessive retention of personal information
• Lack of accountability and designated privacy officer