Canadian Privacy Decisions

The Office investigated two complaints concerning banks revealing excessive personal information through envelope windows. In one case, Social Insurance Numbers were visible. In the other, bankruptcy information was inadvertently displayed on a dormant account notice. Both banks implemented new processes to prevent such disclosures, and the complaints were settled.

• Visibility of SINs through envelope windows
• Disclosure of bankruptcy status on envelopes
• Adequate protection of personal information in mailings

The complainant alleged that an insurance company required her to consent to overly broad collection, use, and disclosure practices when applying for life insurance. While the company's actual practices were found to be consistent with the Act, it agreed to revise its consent language to be more precise and clear. The complainant was satisfied with these assurances, and the matter was settled.

• Clarity and precision of consent language
• Overly broad collection, use, and disclosure practices

The complainant alleged his former employer, an interprovincial trucking company, disclosed his personal information to a creditor without his consent. The investigation found no evidence to support the allegation, and determined the complainant had provided some information himself. The company implemented a privacy policy and appointed an Information Officer.

• Disclosure of personal information without consent

A complainant's original laptop, containing her personal information, was sold by a store after it was returned for repair. The store had failed to wipe the data from the hard drive. The laptop was eventually retrieved and returned to the complainant. The store implemented new policies to ensure customer information is wiped from returned devices, resolving the complaint.

• Adequacy of safeguards for personal information on returned electronic devices
• Employee failure to follow data wiping procedures
• Unauthorized disclosure of personal information

An individual complained that a lending institution disclosed information about her delinquent account to her uncle without her consent. The investigation found merit to the complaint. The institution agreed to apologize to the complainant, adjust her loan, implement privacy policies and practices, establish a privacy committee, provide employee training, and remind staff to limit disclosure during debt recovery. The complainant and the OPC were satisfied with the actions taken, and the case was settled.

• Unauthorized disclosure of personal information
• Lack of privacy policies and practices
• Compliance with PIPEDA obligations

A former employee complained that his former trucking company employer had disclosed personal information about him to other trucking firms after his employment was terminated. The complaint was settled after discussions between the company, the complainant, and the Office. The trucking company agreed to develop privacy policies and procedures and designated a privacy officer, which were confirmed to the Office.

• Disclosure of personal information
• Development of privacy policies and procedures
• Designation of a privacy officer