Canadian privacy & access decisions

The complainant alleged that Yahoo! Canada's default "Stay signed in" setting for Yahoo Mail, particularly for Rogers Yahoo Mail users, posed significant privacy concerns on public or shared computers. The OPC investigated whether Yahoo adequately safeguarded against unauthorized access and obtained valid consent for potential disclosures. The OPC found that Yahoo's safeguards were not appropriate for the sensitivity of email content and that its consent for the "Stay signed in" setting was not meaningful. Yahoo committed to changing the setting to opt-in and providing clearer information about privacy implications. Rogers, while not a respondent, also agreed to implement measures for Rogers Yahoo Mail users. The complaint was found to be well-founded and conditionally resolved.

• Whether Yahoo's safeguards against unauthorized third-party access to email content on public or shared computers were adequate under Principle 4.7 PIPEDA
• Whether Yahoo obtained valid and meaningful consent for the disclosure of personal information to others who subsequently access emails via the "Stay signed in" setting under Principle 4.3 PIPEDA
• Whether the "Stay signed in" setting was clearly and prominently displayed
• Whether a reasonable person would understand the "Stay signed in" setting to be "on" by default
• Whether the "Stay signed in" setting is consistent with industry standards
• Whether Yahoo's additional safeguards (algorithm, sign-out option, session expiration, password reset, security information) were effective
• Whether express opt-in consent was required for the "Stay signed in" setting due to sensitivity of information, reasonable expectations, and risk of harm
• Whether the language "stay signed in" provided users with key information for meaningful consent

The complainant alleged that the Royal Canadian Mounted Police (RCMP) improperly withheld information under subsection 19(1) of the Access to Information Act, concerning a follow-up investigation related to a Code of Conduct decision against the complainant. During the investigation, the RCMP conceded that some of the withheld information was not personal information and issued a supplementary release. However, the RCMP maintained the application of subsection 19(1) on the remaining information. The Office of the Information Commissioner (OIC) found that the remaining withheld information was indeed personal information about another individual, meeting the requirements of the exemption. The OIC also concluded that none of the circumstances under subsection 19(2) that would warrant disclosure existed. Therefore, the complaint was found to be well founded because the RCMP initially withheld information that was not personal information, but the OIC upheld the exemption for the remaining records.

• Whether the information initially withheld by the RCMP constituted personal information under s.19(1) ATIA
• Whether the remaining withheld information was personal information about another individual under s.19(1) ATIA
• Whether the circumstances for disclosure under s.19(2) ATIA existed

The OPC initiated an investigation into CashHere, a short-term lender, after being alerted by the Ontario Ministry of Government and Consumer Services that it was collecting online banking credentials (passwords, usernames, security questions/answers) from loan applicants. The OPC found that while CashHere had a legitimate need to validate identity and income, collecting banking credentials was not an appropriate purpose under PIPEDA s. 5(3) due to less privacy-invasive alternatives and disproportionate privacy risks. The investigation also noted that a related entity, MoneyHome, appeared to be continuing the same practices. CashHere ceased responding to the OPC, and the matter was found to be well-founded and unresolved.

• Whether CashHere's collection of online banking login credentials was for a purpose that a reasonable person would consider appropriate under s. 5(3) of PIPEDA
• Whether the collection of banking credentials was effective in meeting CashHere's legitimate need
• Whether there were less privacy-invasive means of achieving the same ends
• Whether the loss of privacy was proportional to the benefits for CashHere