Canadian privacy & access decisions

The complainant alleged that the Canada Border Services Agency (CBSA) contravened the Privacy Act by disclosing his personal medical information to his bondsperson. The CBSA had carbon copied the bondsperson on a letter containing details about the complainant's health changes while in CBSA detention. The CBSA argued that the information was publicly available because the complainant had included the same medical information in court documents as part of his litigation. The OPC found that the medical information was indeed publicly available in court records, making section 8 of the Privacy Act inapplicable under subsection 69(2). Therefore, the complaint was found to be not well-founded. The OPC noted that had the information not been publicly available, the disclosure would likely have constituted a breach of the Act, as the CBSA's operational bulletin did not sufficiently authorize the disclosure.

• Did the CBSA disclose the complainant’s personal information?
• Was any disclosed information “publicly available”, such that subsection 69(2) of the Act excludes application of sections 7 and 8?
• If not, was the disclosure permitted under subsection 8(2) of the Act?

Two Dell customers complained to the OPC after receiving "tech support scam" calls where fraudsters possessed their personal Dell product information, alleging insufficient security safeguards and inadequate complaint handling by Dell. The OPC's investigation revealed that two employees of Dell's service provider in India had sold customer data lists in June and November 2017, affecting at least 7,883 Canadians. The OPC found Dell responsible for the personal information, concluding that its safeguards related to access controls, logging, monitoring, and technical measures were insufficient given the data's sensitivity and the high-risk environment. Dell also failed to adequately investigate the June 2017 breach and respond to customer complaints. Following the OPC's recommendations, Dell implemented numerous enhancements, including changing service providers, improving security protocols, and revising complaint handling procedures. Consequently, the OPC deemed the matter well-founded and resolved.

• Whether Dell adequately safeguarded personal information under its control while using a service provider (PIPEDA Principle 4.1.3 and 4.7).
• Whether the personal information transferred to the service provider was sensitive enough to require a high degree of protection.
• Whether Dell's access controls were sufficient to protect customer information.
• Whether Dell's logging and monitoring practices were adequate to detect anomalous employee requests for customer information.
• Whether Dell's technical measures, such as USB drive restrictions, were sufficient.
• Whether Dell adequately investigated the circumstances and scope of the June 2017 breach.
• Whether Dell adequately responded to customer complaints about potential privacy breaches (PIPEDA Principle 4.10.4).
• Whether Dell remained responsible for personal information transferred to a third party for processing.