OIPC Annual Report 2008-2009 - Office of the Information and ...

More documents

Recommendations

Info

therefore contravened section 7(1)(c) of PIPA when it used his personal information for this purpose. Since 2004, Johnson has revised its practices to always seek consent from individuals to use their personal information for marketing purposes. This is achieved through specific telephone scripting at first contact, at which time individuals are asked to specifically consent to future contact. ORGANIZATION AUTHORIZED TO DISCLOSE PERSONAL INFORMATION TO POLICE WITHOUT CONSENT (P2009-CS-004, JANUARY 2009) The Complainant suspected there was a problem with his power meter. FortisAlberta Inc. (FortisAlberta) indicated there was no defect with the meter and that the Complainant’s consumption was accurately reflected on his billing statement. The Complainant revealed to FortisAlberta that he is a medical marijuana user and grower, as approved by Health Canada. The Complainant alleged that police later attended his home and advised that FortisAlberta had reported his marijuana growing to police. The Complainant alleged FortisAlberta was not authorized to disclose this information to police. PIPA Fortis Alberta stated that a power line technician (PLT) examined the Complainant’s meter, but determined it was reading properly. The PLT assumed that the Complainant was disputing the large increase in his electricity bill and, as a result, enquired about the Complainant’s consumption. The Complainant revealed he grew marijuana in his home for medical purposes and was legally authorized to do so by Health Canada. Despite the explanation, the PLT remained concerned about the legality of the grow operation and reported his concerns to police. The investigator found that FortisAlberta’s disclosure was made to police “to assist in an investigation” related to a contravention of an enactment of Canada where there was a belief that the “conduct in question…may have occurred.” There was reason to believe that an offense may have occurred in this case, and that police would investigate this information with a view to engaging in a law enforcement proceeding. The investigator found that this met the definition of “investigation” under section 1(f) of PIPA and the requirements of section 20(f) of PIPA. Therefore, FortisAlberta was authorized by section 20(f) of PIPA to disclose information about the Complainant to police without consent. Section 19(1) of PIPA requires that where personal information is disclosed, it is done for “purposes that are reasonable.” Reporting of suspected criminal activity to police is generally considered reasonable given that PIPA does not require consent for such disclosures. The investigator considered that FortisAlberta had no means to confirm the Complainant’s assertion that his grow operation was legal. The disclosure was made in good faith and based on the Complainant’s own admission that he grows marijuana, something generally understood to be illegal. FortisAlberta did reveal to police the Complainant’s assertion that his activity was authorized by Health Canada, but believed police should confirm the information. 2008 - 2009 ANNUAL REPORT 29
PERSONAL INFORMATION PROTECTION ACT PIPA OTHER ACTIVITIES COOPERATION AND CONSULTATION BETWEEN PRIVATE SECTOR PRIVACY REGULATORS Fiscal year 2008-2009 saw continued efforts between the Alberta OIPC and other private sector privacy regulators to work together to collaborate on policy, enforcement and public education. Towards the end of 2008, the Privacy Commissioner of Canada, and the Information and Privacy Commissioners of Alberta and British Columbia signed a Memorandum of Understanding committing to achieving these goals. The Memorandum of Understanding is available on the Alberta OIPC website at www.OIPC.ab.ca. PERSONAL INFORMATION PROTECTION ACT As an example of this collaborative work, in December 2008, the three offices jointly published a document entitled Collection of Driver’s Licence Numbers under Private Sector Privacy Legislation: A Guide for Retailers. Acknowledging the significant number of complaints the Alberta OIPC has received over the past two years related to the collection and recording of driver’s license numbers by organizations, the Guide for Retailers aims to assist organizations in understanding the privacy implications of these practices. Retailers collect driver’s license information for a number of reasons, including to verify the identity of someone using a credit card or picking up merchandise that has already been paid for. Many also use driver’s license numbers to deter and detect fraud, particularly when merchandise is being returned without a receipt. The Guide for Retailers, however, notes that a driver’s license number is a particularly sensitive piece of information which can be valuable to identity thieves, and advises retailers to limit the collection of personal information to the least amount needed to achieve a specific purpose – such as confirming a customer’s identity. Organizations must be able to explain to customers why they are collecting the information. They are also required to protect it with appropriate security measures. The new guidelines explain that many business purposes can be satisfied by simply looking at identification, or, at most, recording the name and address appearing on the license. The guidelines also explain that there is a difference between examining a driver’s license and recording the number on it – or even photocopying the whole document. Recording this kind of sensitive information raises the risk of a privacy breach down the road, while a photocopy involves the collection of information well beyond a name and address, including a photo, signature and physical descriptions. The Guide for Retailers is available on the Alberta OIPC website at www.OIPC.ab.ca. The Alberta OIPC also collaborated with colleagues in British Columbia, Quebec, and the federal Privacy Commissioner’s Office to produce Captured on Camera: Streetlevel Imaging Technology, the Internet and You. 30 OFFICE of the INFORMATION & PRIVACY COMMISSIONER of ALBERTA
Page 2 and 3: OIPC ANNUAL REPORT 2008 - 2009 Prom
Page 4 and 5: TABLE OF CONTENTS OFFICE OF THE INF
Page 6 and 7: COMMISSIONER’S MESSAGE OIPC It wa
Page 8 and 9: OIPC health care costs, health care
Page 10 and 11: THE PROCESS: REQUEST FOR REVIEW / C
Page 12 and 13: BREAKDOWN of CASES CLOSED in 2008 -
Page 14 and 15: VARIANCE OF THIS YEAR’S TOTAL ACT
Page 16 and 17: COMMISSIONER’S MANDATE UNDER THE
Page 18 and 19: Consultation to Public Bodies The C
Page 20 and 21: HEALTH INFORMATION ACT (HIA) The He
Page 22 and 23: INVESTIGATION REPORT H2008-IR-002 A
Page 24 and 25: INVESTIGATION REPORT H2009-IR-002 A
Page 26 and 27: PERSONAL INFORMATION PROTECTION ACT
Page 28 and 29: sensitive personal information in t
Page 30 and 31: and addresses and phone numbers whe
Page 34 and 35: This document recognizes that a num
Page 36 and 37: ORDERS IN THE COURSE OF REVIEWING T
Page 38 and 39: The Adjudicator also determined tha
Page 40 and 41: the personal information of the pol
Page 42 and 43: JUDICIAL REVIEWS & OTHER COURT DECI
Page 44 and 45: The pawnshops and second-hand store
Page 46 and 47: The Court of Appeal first considere
Page 48 and 49: TABLE 1: CASES OPENED 2008 - 2009 F
Page 50 and 51: GRAPH 1: TOTAL NUMBER OF CASES OPEN
Page 52 and 53: TABLE 3: CASES OPENED BY PUBLIC, BO
Page 54 and 55: GRAPH 3: PERCENTAGE OF CASES CLOSED
Page 56 and 57: [Original signed by Fred Dunn, FCA]
Page 58 and 59: STATEMENT OF FINANCIAL POSITION AS
Page 60 and 61: NOTES TO THE FINANCIAL STATEMENTS Y
Page 62 and 63: NOTE 3 SUMMARY OF SIGNIFICANT ACCOU
Page 64 and 65: NOTE 5 DEFINED BENEFIT PLANS The Of
Page 66 and 67: SCHEDULE 1 - SALARY & BENEFITS DISC
Page 68 and 69: APPENDIX A: CASES OPENED 2008 - 200
Page 70 and 71: APPENDIX C: ORDERS & PUBLIC INVESTI
Page 72 and 73: APPENDIX D: ACCEPTED PRIVACY IMPACT

OIPC Annual Report 2008-2009 - Office of the Information and ...

Create successful ePaper yourself

Delete template?

Save as template?