Canadian privacy & access decisions

A complainant sought to open an online financial investment account with a FinTech organization. To access the investment account management agreement, the complainant was required to provide personal information, some of which was sensitive. After reviewing the agreement, the complainant decided not to open an account and requested deletion of their personal information. The organization cited "regulatory requirements" for the collection. The OPC clarified that while regulatory requirements exist, they apply once an individual becomes a client, not before. The OPC advised the organization to revise its website so prospective clients could review the agreement without prior personal information disclosure. The organization agreed to revise its website and Privacy Policy, leading to an early resolution.

• Whether a FinTech organization can require personal information before a prospective client reviews terms and conditions
• Whether consent under PIPEDA is meaningful if personal information is collected before a user can review service agreements
• Whether regulatory requirements justify collecting personal information from prospective clients who do not proceed with opening an account