Canadian privacy & access decisions

An individual (the plaintiff) filed a complaint after a psychiatrist, retained by an insurance company to assess the plaintiff's well-being for a civil lawsuit, did not provide full access to his personal information. The plaintiff had requested access to his personal information held by the psychiatrist and received only a redacted report, leading to concerns about the completeness and accuracy of the information. The OPC investigated whether the psychiatrist's collection and use of the plaintiff's personal information constituted a "commercial activity" under PIPEDA. The OPC determined that defending against a civil lawsuit is not a commercial activity, and therefore, PIPEDA did not apply. The complaint was ultimately dismissed due to lack of jurisdiction.

• Whether the collection and use of a plaintiff’s personal information for the purpose of defending against a civil lawsuit constitutes a "commercial activity" under PIPEDA
• Whether PIPEDA applies to the activities of a third-party retained to carry out an activity exempt from PIPEDA

An individual complained that a telecommunications company (telco) provided an incomplete response to her access request for information about disclosures of her personal information to other parties, including law enforcement. The telco initially responded by stating it was in compliance with specific PIPEDA subsections, without confirming or denying disclosures. The OPC found that the telco's response did not meet its obligation under Principle 4.9 of PIPEDA, which requires organizations to inform individuals of the existence, use, and disclosure of their personal information. The OPC clarified that an organization must provide a clear 'yes' or 'no' answer regarding disclosures, unless a government institution objects to such disclosure under PIPEDA s.9(2.4). Following the OPC's recommendation, the telco provided a complete response to the complainant and updated its policy for handling future access requests. The complaint was deemed well-founded and resolved.

• Whether the telco's initial response to an access request for disclosure information met its obligations under Principle 4.9 of PIPEDA
• Whether the telco's practice of stating compliance with PIPEDA s.9(2.1)-(2.4) was sufficient for access requests
• Whether the telco had an obligation to provide a 'yes' or 'no' answer regarding disclosures to all third parties, including those not covered by PIPEDA s.9(2.1)-(2.4)
• How an organization should respond to an access request for disclosure information when a government institution objects under PIPEDA s.9(2.4)