Canadian Privacy Decisions

Biron Health Group sent promotional emails to travellers who had undergone COVID-19 testing upon arrival in Canada, using their email addresses collected for testing purposes. The complainant alleged this violated PIPEDA. Biron argued they assumed implicit consent due to a business relationship, but the OPC found this assumption unreasonable given the mandatory nature of the testing. Biron has since ceased the practice, deleted affected email addresses, and the complaint was settled.

• Use of personal information for secondary marketing purposes without consent
• Reasonableness of assuming implicit consent in a mandatory service context
• Nature of consent required for collecting and using health-related information

The complainant alleged that Public Services and Procurement Canada (PSPC) failed to provide records regarding a specific contract. PSPC stated they could not identify relevant records, claiming they were not in their possession. The Information Commissioner found that while the records (a subcontract and related documents) were not in PSPC's physical possession, they were under PSPC's control for the purposes of the Access to Information Act. Therefore, PSPC should have retrieved and processed these records.

• Whether records held by a third-party contractor are under the control of a federal institution.
• Whether the institution conducted a reasonable search for the requested records.
• The interpretation of the 'under the control' clause in the Access to Information Act.