Recently, the Privacy Commissioner of Canada (the "Commissioner") released a series of findings based on individual complaints under the Personal Information Protection and Electronic Documents Act ("PIPEDA")
- An Internet Service Provider ("ISP") had received a request for personal information regarding a subscriber's account, but did not release the information for 34 days. The Commissioner concluded that the ISP had contravened PIPEDA by releasing the complainants information 4 days beyond the time prescribed by the privacy legislation. For the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_1_e.asp
- On an individual's complaint that a bank was asking for a high fee to provide him with access to information relating to his bank loan, the Commissioner found that bank had contravened PIPEDA for failing to respond at a minimal cost to the individual. Upon the intervention of the Commissioner's office, the bank agreed to a much lower fee.
To view the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_2_e.asp - The Commissioner found that a company which failed to provide a complete set of information in an employment file had breached PIPEDA for failing to provide access to all of the information that an employee was entitled to upon request.
For a copy of the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_3_e.asp - The Commissioner concluded that he lacked jurisdiction to investigate a complaint that a subsidiary of a bank, an investment and brokerage service, had disclosed a client's information to the U.S. Internal Revenue Services without consent.
To view the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_4_e.asp - The Commissioner found that a bank had breached PIPEDA for disclosing an individual's personal credit card information to her husband without her knowledge or consent.
For a copy of the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_5_e.asp - The Commissioner objected strongly to a flight training form that required commercial airline pilots to authorize the U.S. Department of Justice to obtain and disclose any information relevant to requests for flight training from any relevant source.
To view the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_7_e.asp - A customer had provided his Social Insurance Number ("SIN") when he had purchased an interest-bearing product from the bank. Later, this number had also been used when he sought to activate his credit card. The bank was found to have contravened PIPEDA for using this information without his consent for a purpose other than that for which it had originally been collected.
For a copy of the Commissioner's decision, visit: (#105) http://www.privcom.gc.ca/cf-dc/cf-dc_021219_8_e.asp - The Commissioner found that a telecommunications company, which required a customer to provide his credit card number or his Social Insurance Number to facilitate a credit check as a condition for supplying service, had met its obligations under PIPEDA. The company explicitly stated the purpose for the collection of information and used the information only for that purpose. In addition, the company offered an alternative payment plan for customers who did not wish to provide a credit check.
For the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_9_e.asp - A railway company contravened PIPEDA by refusing an employee's request for access to a letter that the company had sent to his personal physician. The Commissioner found that the employer could not validly rely on the provisions of the PIPEDA which provided for exemptions when the disclosure would reveal personal information about third parties or threaten the life or security of another individual.
To view the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_10_e.asp - The Commissioner held that a credit reporting agency had breached PIPEDA as a result of its delayed response to an individual's request for his credit history. However, given that the agency eventually provided the complainant with the information and assisted him in explaining a disputed entry to third parties, the complaint was found to have been resolved.
For the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_11_e.asp - An individual complained against her former employer for refusing her request for access to her human resources file. The company indicated that at the time of the request, it was unaware of its responsibility under PIPEDA to grant access to personal information upon request. Upon notification by the Commissioner's Office, the company disclosed the employee information in compliance with PIPEDA.
To view the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_12_e.asp - A woman complained that a bank employee disclosed information about her bank account to her mother. The Commissioner found that the bank had contravened PIPEDA by disclosing the woman's personal information without her knowledge and consent.
For a copy of the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021219_13_e.asp - A complaint was brought against a telecommunications company for disclosing an individual's unlisted phone number to a collection agency that was attempting to locate a third party. The Commissioner stated that the complainant's phone number was personal information and concluded that the company had breached s. 5(3) of PIPEDA.
For the Commissioner's findings, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021202_2_e.asp - An individual complained that a securities company required a copy of his driver's license for identification when he changed investment advisors despite the fact that he had recently disclosed his SIN for that same reason. The Commissioner found that given that PIPEDA applies to federal works, the provincially regulated security company was not subject to the legislation. For this reason, the Commissioner concluded that he lacked jurisdiction to investigate the complaint.
For a copy of the Commissioner's decision, visit: http://www.privcom.gc.ca/cf-dc/cf-dc_021022_4_e.asp
E-TIPS® ISSUE
03 01 20
Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.
E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.
