Canadian privacy & access decisions

An individual complained that a collection agency repeatedly refused to provide access to their personal information, despite multiple written requests. The individual was disputing a debt the agency was attempting to collect and sought information related to the alleged debt account. The OPC found that the agency failed to respond to several of the individual's access requests, contravening PIPEDA subsections 8(3) and 8(5), and Principle 4.9. Although the agency eventually provided the information during the investigation, the OPC noted that the agency had not followed its own privacy procedures for handling access requests. The agency committed to revising its procedures and providing refresher training to its employees. The complaint was deemed well-founded and resolved.

• Whether the organization refused to provide access to personal information
• Whether the organization responded to access requests within the required timeframe
• Whether the organization followed its own privacy policies and procedures for access requests
• Whether the organization maintained records of access request processing

A complaint was filed against Canada Post Corporation (CPC) regarding its collection, use, and disclosure of electronic signatures for parcel tracking. The complainant raised concerns about the clarity of information provided to addressees regarding their option to opt-out of having their signature displayed online, and the absence of labels on signature devices at a specific postal outlet. The investigation also examined the privacy and security controls of CPC's online tracking website. CPC argued that disclosure of signatures to senders was authorized under the Privacy Act and that it provided an opt-out option. The OPC found that the collection and disclosure of signatures for parcel tracking were consistent with the Act, but raised concerns about the adequacy of security controls for online signatures. CPC committed to implementing enhanced security measures.

• Whether the collection of electronic signatures by CPC contravenes the Privacy Act
• Whether the disclosure of electronic signatures to the sender of a parcel contravenes the Privacy Act
• Whether the disclosure of electronic signatures online contravenes the Privacy Act
• Whether CPC adequately safeguards digitized signatures displayed online
• Whether the information provided to addressees about opting out of online signature display is sufficiently clear