Canadian privacy & access decisions

An individual complained that a DVD-rental store required him to provide his driver's license details for entry into their database to become a member, which he believed was unnecessary. The store initially argued this was a business necessity for identity verification and recovering overdue rentals. However, the investigation revealed the store did not use driver's license data for tracing members, but rather publicly available information. Recognizing it was collecting unnecessary information, the store revised its membership process. Under the new process, customers must present two pieces of identification, one with a photo, but driver's license details are no longer entered into the database. The store committed to updating its procedures and training staff on the new process.

• Whether collecting and recording driver's license details was necessary for the DVD-rental store's operations
• Whether the store's collection practices aligned with the principle of limiting collection to necessary information

The OPC investigated two incidents involving misdirected faxes from two banks, which resulted in personal information being sent to unintended recipients over several years. In both cases, the recipients attempted to notify the banks, but the issues were not escalated or resolved until media reports brought them to public attention. The investigations found that the banks failed to adequately safeguard personal information and ensure their privacy policies were effectively implemented by employees. While the banks took corrective measures during the investigation, the OPC made further recommendations to improve internal communication of breaches, customer notification, fax transmission verification, and recovery of misdirected information. Both banks fully implemented these recommendations.

• Whether organizations adequately safeguard personal information to prevent inappropriate disclosure (Principle 4.7 PIPEDA)
• Whether organizations implement effective policies and procedures to give effect to fair information practices (Principle 4.1 PIPEDA)
• Whether employees are attuned to privacy issues and can respond to problems when they arise
• Whether organizations notify affected customers of privacy breaches
• Whether organizations have processes for confirming correct fax transmission
• Whether organizations have measures to recover erroneously transmitted customer information