Canadian privacy & access decisions

The OPC received two separate complaints against two different banks concerning the improper disclosure of personal information through envelope windows. In the first case, a complainant received RRSP transfer documents where Social Insurance Numbers (SINs) were visible through the envelope window. The bank acknowledged the issue and implemented a new process to ensure SINs and account numbers are not visible. In the second case, a complainant received a dormant account notice where the word "Bankrupt" and a date were visible through the envelope window below his name. The bank modified its process for client profile notations to prevent such information from appearing in the address field. Both complaints were settled during the course of the investigations, with the banks taking satisfactory corrective actions.

• Whether Social Insurance Numbers visible through an envelope window constituted inadequate protection of personal information under PIPEDA
• Whether a bankruptcy notation visible through an envelope window constituted improper disclosure of personal information under PIPEDA
• Whether the banks' practices for handling and displaying personal information on mailings met PIPEDA's protection requirements

An individual complained that his former employer, an interprovincial trucking company, disclosed his personal information to a creditor without his consent. The investigation found no evidence to support this allegation; in fact, the complainant had provided some of the information to the creditor himself. During the investigation, the trucking company, a small family-owned business, developed and implemented a written privacy policy, appointed an Information Officer, and reviewed its practices regarding employee information. The company also took steps to ensure its employees were aware of fair information handling practices. Both the complainant and the OPC were satisfied with these actions, and the matter was settled.

• Whether the trucking company disclosed the complainant's personal information to a creditor without consent