Canadian Privacy Decisions

A complainant was required to provide his driver's licence details to rent DVDs from a store. He objected to the store entering these details into its database, believing it unnecessary. The store initially defended the practice but later revised its membership application process after realizing it did not use the driver's licence data to trace members. The revised process allows for alternative forms of identification, and only a general confirmation of verification is entered into the database.

• Necessity of collecting driver's licence details
• Use of personal information for membership verification
• Revision of data collection practices

The Office of the Privacy Commissioner of Canada investigated two separate incidents involving misdirected faxes containing personal information at two banks. In both cases, the banks failed to adequately safeguard personal information, leading to its disclosure to unintended recipients. While both banks took corrective actions, including revising policies and procedures, the OPC recommended further improvements in customer notification and information recovery.

• Adequacy of safeguards for personal information transmitted by fax
• Effectiveness of privacy policies and employee awareness
• Timeliness and scope of customer notification following a privacy breach
• Procedures for recovering erroneously transmitted personal information