Canadian privacy & access decisions

A complainant alleged that his financial institution improperly disclosed his personal information, specifically RESP account details from 1999, to a municipal police service. The financial institution claimed the disclosure was made under a production order or, alternatively, with the complainant's consent via its privacy policy. The OPC found that the disclosed 1999 RESP information fell outside the scope of the production order, which specified a different date range and nature of information. The OPC also rejected the financial institution's argument of consent, stating that the privacy policy's general language was insufficient for informed consent, especially for sensitive financial information. The financial institution agreed to review its procedures and provide training to ensure compliance with production orders. The complaint was found to be well-founded and resolved.

• Whether the disclosure of RESP account information from 1999 was justified under paragraph 7(3)(c) of PIPEDA as being required by a production order
• Whether the financial institution could rely on the complainant's consent, as stipulated in its privacy policy, for the disclosure of personal information to law enforcement
• Whether the RESP account information constituted sensitive personal information

A complainant alleged that a company selling "home history reports" collected, used, and disclosed personal information without consent, specifically sales history, drug activity, and insurance claims. The OPC found that sales history was no longer included in reports and insurance claims information, as clarified by the respondent, related to property damage paid to third parties, not individuals, thus not constituting personal information. However, information about drug activity was deemed personal information because it could be linked to identifiable individuals and suggested their involvement in drug activity. The OPC concluded that this drug activity information was not "publicly available" under PIPEDA Regulations, requiring consent for its use. The respondent agreed to cease including drug activity details in its reports, leading to a well-founded and resolved outcome.

• Whether sales history information constituted personal information and was collected, used, or disclosed without consent
• Whether insurance claims information constituted personal information
• Whether drug activity information constituted personal information
• Whether drug activity information was "publicly available" under the Regulations Specifying Publicly Available Information
• Whether the respondent obtained adequate consent for the collection, use, and disclosure of personal information

The Office of the Privacy Commissioner of Canada (OPC) initiated a complaint against Wajam Internet Technologies Inc., an adware developer, regarding its software's installation, consent, uninstallation, and data handling practices. The software, Wajam or Social2Search, tracked online search queries, overlaid social media results, and displayed contextual ads. The OPC investigated whether Wajam obtained meaningful consent for installation, allowed users to withdraw consent, and adequately safeguarded personal information. The investigation found that Wajam lacked a privacy accountability framework, failed to obtain meaningful consent due to problematic third-party distribution methods and misleading information, indefinitely retained unencrypted raw user data, and had insufficient safeguards. All examined matters related to accountability, consent, limiting retention, safeguards, and openness were found to be well-founded. Wajam, having sold its assets to a Hong Kong-based company, IMTL, claimed it was unable to implement the OPC's recommendations, though it agreed to securely destroy Canadian user data. The OPC requested Wajam provide the report to IMTL and stated it would monitor the situation and engage international counterparts.

• Whether Wajam Internet Technologies Inc. had an adequate privacy accountability framework in place (Principle 4.1.4 PIPEDA)
• Whether Wajam obtained meaningful consent from individuals for the installation and operation of its software (Principle 4.3, 4.3.2, 4.3.5 PIPEDA, s.6.1 PIPEDA)
• Whether Wajam's third-party distribution model ensured meaningful consent for software installation
• Whether Wajam's multiple-offer consent screens provided sufficient information for meaningful consent
• Whether the information provided by Wajam about its software's functionality and privacy practices was accurate and complete (Principle 4.2, 4.3.2, 4.3.5 PIPEDA)
• Whether Wajam permitted users to withdraw consent by making it difficult to uninstall its software (Principle 4.3.8 PIPEDA)
• Whether Wajam was responsible for unsolicited ads and fake offers presented during the uninstallation process (Principle 4.3 PIPEDA)
• Whether Wajam limited the retention of personal information to only as long as necessary for identified purposes (Principle 4.5, 4.5.2 PIPEDA)
• Whether Wajam was open about its policies and practices relating to the management of personal information (Principle 4.8 PIPEDA)
• Whether Wajam adequately safeguarded users' personal information against loss, theft, or unauthorized access, including during transmission and storage (Principle 4.7.1, 4.7.2, 4.7.3 PIPEDA)

An individual complained after an insurance company refused to provide access to her personal information following an incident at a store. The individual sought access to her insurance claim file, including case management notes and a video of the incident. The company initially refused, citing confidential commercial information and the personal information of third parties. Through the OPC's early resolution process, the company agreed to allow the individual to view the video and provided a redacted copy of the case management notes. The OPC's Early Resolution Officer reviewed the redactions to ensure they were properly applied. The complaint was resolved to the satisfaction of both parties.

• Whether an organization must provide an individual with access to their personal information upon request
• Whether case management notes constitute "confidential commercial information" under PIPEDA paragraph 9(3)(b)
• Whether a video containing images of third parties can be withheld from an access request
• Whether an organization can fulfill its access obligations by allowing viewing of a record rather than providing a copy
• Whether redaction of confidential commercial information or third-party personal information is an appropriate method to grant access