Canadian privacy & access decisions

A customer complained that a retail store employee disclosed his personal information to his employer, including his name, in-store behavior, and statements made to staff. The store argued the information was not personal because it was made publicly, and that it had implied consent for the disclosure. The OPC found that information overheard by others is still personal information under PIPEDA. The OPC also determined that implied consent was not appropriate given the sensitive nature of the information, which had the potential to negatively affect the customer's employment. The store's disclosure without knowledge or consent contravened Principle 4.3 of PIPEDA. The complaint was found to be well-founded and resolved after the store implemented the OPC's recommendations.

• Whether the information shared was personal information under PIPEDA
• Whether the customer provided implied consent for the disclosure of his personal information
• Whether the disclosed information was sensitive
• Whether the customer had a reasonable expectation that his information would be shared with his employer
• Whether the publicly available information exception to consent applied