Canadian privacy & access decisions

A complainant alleged that a courier company disclosed her personal information without consent by delivering a package containing financial documents to her neighbour. The courier company's policy allowed drivers to deliver packages to neighbours if the addressee was not home, a practice the complainant was unaware of as she was not expecting the package. The OPC found that the courier company contravened Principle 4.3 of PIPEDA by failing to obtain consent for this practice, either directly from the complainant or by ensuring the shipper had obtained it. The OPC noted that the sensitivity of the package's contents and the complainant's unlisted phone number on the label heightened the need for express consent. The courier company committed to ending the 'delivery to a neighbour' practice in response to the OPC's recommendations. The OPC later confirmed the practice had ceased.

• Whether the courier company obtained valid consent for delivering a package to a neighbour
• Whether the courier company exercised due diligence to ensure the shipper obtained consent for 'delivery to a neighbour'
• Whether the information disclosed (name, address, unlisted telephone number, and package contents) was sensitive in context