Canadian privacy & access decisions

A complainant alleged that a charitable organization (the Respondent) failed to obtain proper consent before sharing his personal information through a donor list trading program. The Respondent used an opt-out checkbox on its mail-in donation forms, which the complainant found inadequate after receiving solicitations from another charity. The OPC determined that sharing donor information with other charities for solicitation purposes was outside the reasonable expectations of donors, thus requiring express opt-in consent. Furthermore, the information provided by the Respondent on its donation forms, inserts, and privacy policy was deemed insufficient to enable meaningful consent. The OPC recommended that the Respondent obtain express opt-in consent and enhance its privacy communications to clearly explain the nature, purpose, and consequences of the data sharing. The Respondent agreed to implement these recommendations, leading to a conditionally resolved outcome.

• Whether the Respondent obtained meaningful consent for its donor list trading program under PIPEDA
• Whether opt-out consent was appropriate for sharing donor information with third parties
• Whether the information shared (donor name, address, donation status) was sensitive in this context
• Whether sharing donor information with other charities for solicitation was within the reasonable expectations of donors
• Whether the donor list trading program created a meaningful residual risk of significant harm
• Whether the information provided to donors on the donation form, insert, and privacy policy was sufficient to support meaningful consent