Canadian Privacy Decisions

This investigation concerned a complaint against Health Canada (HC) regarding the mailing of 41,514 letters using windowed envelopes that revealed the name of the "Marihuana Medical Access Program" (MMAP). The Office of the Privacy Commissioner of Canada (OPC) found that HC contravened the Privacy Act by disclosing sensitive personal information without consent or legitimate purpose. Although HC cited administrative error and argued implicit consent or consistent use, the OPC determined that the sensitive nature of the program name required greater protection. HC has since implemented stricter mail-out procedures and created a new working group.

• Whether the visible program name in the return address constituted a disclosure of personal information.
• Whether implied consent was obtained from recipients.
• Whether the disclosure was a 'consistent use' of information under section 8(2)(a) of the Privacy Act.
• Whether Health Canada took reasonable steps to protect sensitive personal information.