Canadian privacy & access decisions

An individual complained that a loyalty program shared his children's names and addresses with partner credit card companies, resulting in marketing materials being sent to the minors. The loyalty program stated it does not market to minors or share their information with partners. However, due to telephone account openings where birth dates were not mandatory, the children were not identified as minors in their profiles. This led to their information being shared for marketing purposes. The program acknowledged an overly long delay in correcting the issue, partly due to marketing lists being generated weeks in advance. The loyalty program sent an apology letter, and the mailings to the children ceased. The complaint was considered settled.

• Whether the loyalty program inappropriately disclosed personal information of minors to partner companies for marketing purposes
• Whether the loyalty program adequately protected the personal information of minor members
• Whether the loyalty program took appropriate and timely steps to resolve the complaint

An individual complained that a web-based company retained his personal information for too long after he cancelled his free trial membership. He also alleged that the company lacked accountability under PIPEDA, as it did not fully answer his privacy questions and had no designated privacy officer. The company explained that it retained personal information, including credit card details, to process rental requests, ship items, and prevent fraud, particularly to track individuals attempting to obtain multiple free trials. As a result of the complaint, the company revised its privacy policy to clarify retention purposes and periods for different types of information. It also trained its customer service staff and designated a privacy officer. The complainant was satisfied with these changes.

• Whether the web-based company retained personal information for too long after a free trial cancellation
• Whether the web-based company was fully accountable under PIPEDA
• Whether the web-based company adequately answered privacy-related questions
• Whether the web-based company had a designated person responsible for handling privacy issues