Canadian privacy & access decisions

The Canada School of Public Service (the School) received a letter from the Public Sector Integrity Commissioner (PSIC) detailing allegations of wrongdoing against seven employees. The School then hand-delivered copies of this letter, which identified the seven individuals and the alleged wrongdoings, to each of the named employees. One of these employees complained to the OPC, alleging that the disclosure of his name via this letter violated the Privacy Act. The OPC found the complaint to be well-founded, concluding that the School had improperly disclosed personal information. Following the OPC's recommendations, the School developed new procedures to protect the confidentiality of information related to the Public Servants Disclosure Protection Act and a plan for addressing privacy breaches.

• Whether the Canada School of Public Service disclosed personal information contrary to the Privacy Act by hand-delivering a letter from the Public Sector Integrity Commissioner to employees named in it

A B.C. woman received a package from the Canada Revenue Agency (CRA) containing her deceased daughter's tax information along with the confidential personal information of five other individuals. She attempted to report the data breach and return the misdirected information to the CRA through various channels, including phone calls and an in-person visit to a tax centre, but faced significant difficulties. Only after she contacted a CBC news reporter did the CRA take prompt action to retrieve the misdirected records. The OPC launched a Commissioner-initiated complaint and found that the CRA had breached the privacy rights of the taxpayers involved. The CRA committed to and implemented remedial measures to prevent similar incidents and improve its internal procedures for client service and misdirected mail.

• Whether the Canada Revenue Agency breached the privacy rights of taxpayers by mistakenly sending confidential personal information to an unauthorized individual
• Whether the Canada Revenue Agency's procedures for handling misdirected mail and breach reporting were adequate
• Whether the Canada Revenue Agency's client service channels were accessible for reporting privacy breaches

The Canadian Council for Refugees complained that the Canada Border Services Agency (CBSA) improperly disclosed an individual's personal information on its "Wanted by the CBSA" website. The program aimed to solicit public help in locating individuals with Canada-wide warrants for removal, including those accused of war crimes. The OPC found that while the disclosure of personal information was permissible under the Privacy Act as a consistent use for immigration law enforcement, the CBSA failed to ensure the information was accurate, up-to-date, and complete. Specifically, the website implied a conviction for war crimes when the individual was only deemed inadmissible under immigration law. This led to a well-founded finding regarding the accuracy of the information. The CBSA accepted five recommendations, including revisiting the amount of personal information disclosed, clarifying the distinction between criminal conviction and immigration determination, and improving the timely removal of profiles.

• Whether the disclosure of personal information on the "Wanted by the CBSA" website was permissible under the Privacy Act as a consistent use
• Whether the CBSA took all reasonable steps to ensure the personal information was accurate, up-to-date, and complete as required by the Privacy Act
• Whether the CBSA should have conducted a Privacy Impact Assessment before launching the program

An individual complained that an equipment store required a scanned copy of his driver's license and a photograph as a condition for renting equipment. The store justified this practice by citing past losses of expensive rental equipment. The OPC informed the store that collecting driver's license information in this manner was generally inappropriate due to the excessive personal information contained on the license and its limited value in theft investigations. The OPC provided guidance on appropriate collection practices. As a result of the OPC's intervention, the store implemented a less privacy-invasive solution and trained its staff. The complainant was satisfied with the outcome.

• Whether requiring a scanned copy of a driver's license and a photograph for equipment rental constitutes appropriate collection of personal information under PIPEDA
• Whether the collection of driver's license information is justified for addressing customer theft

A complaint was filed on behalf of RCMP members regarding the disclosure of informal disciplinary records to the Crown, arguing it was inconsistent with the Supreme Court's R. v. McNeil decision. The complainant contended that only records from formal disciplinary hearings should be disclosed. The RCMP maintained that both formal and informal misconduct records could be relevant under McNeil, and the OPC agreed with this interpretation, finding the complaint not well-founded. However, the OPC expressed serious concerns about the RCMP's policy of retaining disciplinary records until members reach 100 years of age, which is significantly longer than other police services. The OPC recommended the RCMP reconsider its retention policies, but the RCMP indicated it would continue its current practice.

• Whether the disclosure of informal disciplinary records to the Crown is consistent with R. v. McNeil
• Whether the RCMP's retention period for disciplinary records is appropriate

This report details an investigation into the loss of a USB key containing the personal information of 5,045 Canada Pension Plan Disability appellants from an ESDC office. The USB key, which was neither password-protected nor encrypted, contained sensitive data including SINs, medical conditions, and dates of birth. The investigation found weaknesses in physical, technological, administrative, and personnel controls at both ESDC and Justice Canada, as a Justice Canada lawyer had custody of the key when it went missing. The OPC concluded that both departments failed to translate their privacy and security policies into meaningful business practices. Both ESDC and Justice Canada accepted nine recommendations from the OPC to improve their protection of personal information.

• Whether Employment and Social Development Canada (ESDC) adequately protected personal information on a lost USB key
• Whether Justice Canada adequately protected personal information on a lost USB key while in its custody
• Whether physical controls for personal information were adequate
• Whether technological controls (encryption, password protection) for personal information were adequate
• Whether administrative controls for personal information were adequate
• Whether personnel controls for personal information were adequate
• Whether ESDC translated its privacy and security policies into meaningful business practices
• Whether Justice Canada translated its privacy and security policies into meaningful business practices