New PIPEDA finding: Collection of health information by employer

The first summary finding of 2005 has been released by the Canadian Privacy Commissioner. In it, the Commissioner concludes that the complainant's employer did not violate PIPEDA by seeking medical information about the employee who occupies a "safety sensitive" position. The complainant also alleged that the employer collected information directly from his/her physician without consent, a complaint that was well-founded.

Commissioner's Findings - PIPEDA Case Summary #287: Request for medical information deemed reasonable, but consent procedures not properly followed - January 5, 2005 - Privacy Commissioner of Canada:

"...An employee of a transportation company made two allegations against his employer: (1) that his employer was requiring him to provide more medical information than necessary and would not allow him to return to his position until he supplied the information; and (2) that the company obtained medical information about him from his doctor without his consent...."

I am informed by a colleague who made an inquiry of the Office of the Privacy Commissioner that finding summaries are going to be published less frequently than in the past. This is unfortunate. Desipte their serious shortcomings, these findings provide the only insight into the Commissoner's thought process and also make good case studies to teach companies how to deal with PIPEDA.

PIPEDA Case Summary #282: Excessive disclosures in the pursuit of a debt - October 21, 2004

Ther Personal Information Protection and Electronic Documents Act allows an organization to disclose personal information without consent in connection with the collection of a debt owed to that organization (see s. 7(3)(b) of the Act). This does not, however, provide blanket permission to disclose the debtor's circumstances and credit history in doing so. The Privacy Commissioner's office has just released finding #282, in which an individual complained about excessive disclosure during collections actions by a bank:

Commissioner's Findings - PIPEDA Case Summary #282: Excessive disclosures in the pursuit of a debt - October 21, 2004 - Privacy Commissioner of Canada: "An individual claimed that a bank disclosed a significant amount of his personal information to two of his employees without his consent. The complainant alleged that these disclosures were extremely damaging to his reputation and contributed to his decision to resign as the head of a company."

The complainant alleged, an produced compelling evidence, that the bank in question "had told [the complainant's employees] that the complainant’s account was severely delinquent, his credit card was suspended from further use, his payment history was sketchy, the bank was intending to enforce its claim against the complainant, and as part of that enforcement, was going to garnish his wages, which would be embarrassing for both the company and the complainant."

The Assistant Privacy Commissioner was not amused. She found:

• While acknowledging that an organization may disclose an individual’s personal information without consent for the purpose of collecting a debt, this exception did not confer, as noted in an earlier finding made by this Office, a carte blanche upon an organization to disclose however much information it wished in pursuing a debt.
  
• In this instance, there was clear documentary evidence, from the tape recording as well as from the sworn affidavits, that an excessive amount of information was divulged during the bank’s debt collection activities.
  
• The bank had stated that it was calling the complainant’s employees to verify his employment and that it was planning to garnish his wages. While the Assistant Commissioner acknowledged that an organization must disclose some information to an employer when seeking to garnish the debtor’s wages, in her opinion, the bank went too far in its attempt to recover the debt.
  
• There was no need to reveal the debtor’s payment history, the amount of money owed, or that the debtor’s credit card was suspended from further use, to name but a few examples of information that the Assistant Commissioner considered excessive.
  
• She thus found the bank in contravention of Principle 4.3.

In short, any organization collecting a debt may only disclose the minimum amount of personal information necessary. Any more, and you are likely offside.

PIPEDA Case Summary #281: Organization uses biometrics for authentication purposes

The Privacy Commissioner released a new finding yesterday (the finding itself is dated September 3, 2004), the first finding to address the mandatory use of biometrics in the workplace. In this case, the employer used voice-print technology for security and managing the employer-employee relationship. The Assistant Commissioner determined that the use of this technology was reasonable, and struck the appropriate balance for security purposes.

Commissioner's Findings - PIPEDA Case Summary #281: Organization uses biometrics for authentication purposes - September 3, 2004 - Privacy Commissioner of Canada:

"Several employees complained that their employer was forcing them to consent to the collection of biometric information, namely, their voice print, for the purpose of accessing a number of the company's business applications. These applications are used for logging work-related information, as well as for absence reporting. "

PIPEDA Case Summary #315: Web-centred company's safeguards and handling of access request and privacy complaint questioned (August 9, 2005)

The Office of the Privacy Commissioner just released a finding related to a free e-mail provider's PIPEDA compliance, particularly with respect to access, security and challenging compliance. The complainant thought her estranged husband had been accessing her e-mail and was responsible for changing her password on a number of occasions. Trying to deal with customer service people at the e-mail provider proved fruitless and the Assistant Commissioner found that the company was not in compliance with Principle 10 of PIPEDA, which requires that any complaints be escalated to the company's privacy officer. The Assistant Commissioner also concluded that the IP address of the person who had been resetting her password might be information about a third-party, but the company could release it to the complainant becuase it could not be linked to a third-party without the assistance of the ISP involved. Finally, the Assistant Commissioner concluded that the company could not be faulted for inadequate security because the customer didn't follow the instructions to make her own password and "personal question" more secure. Read the full finding here: Commissioner's Findings - PIPEDA Case Summary #315: Web-centred company's safeguards and handling of access request and privacy complaint questioned (August 9, 2005).

PIPEDA Case Summary #314: Insurance company denies access to personal information in statement of claim (August 9, 2005)

The Office of the Privacy Commissioner has just posted to its website a finding related to a complaint filed by an insured under an automobile policy who was looking for information about a claim that has been filed by a third party related to damage to a motor vehicle. Though the insurer settled the claim, the insured disputed whether she was at fault.

The insurer refused to provide the insured with access to the particulars of the claim because, in its view, it contained personal information about the claimant. That information, it argued, could not be disclosed without consent under PIPEDA. The insurer attempted to get this consent and was not able to do so.

The insured enlisted the help of the province's superintendent of Insurance but to no avail. She then complained to the Privacy Commissioner that she was denied access to her personal information under Principle 9 of PIPEDA.

The Privacy Commissioner concluded that the third-party personal information should have been severed from the records and the remainder provided to the insured:

Commissioner Findings - PIPEDA Case Summary #314: Insurance company denies access to personal information in statement of claim (August 9, 2005)

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. An exception to access is included in subsection 9(1), which states that an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the information about the third party is severable from the record containing the information about the individual, the organization shall sever the information about the third party before giving the individual access.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• Based on her review of the statement of claim in question, the Assistant Commissioner was of the opinion that some of the information in the statement of claim was the complainant personal information.
  
• While she noted that the statement also contained the third party claimant's personal information, this information could be severed in the manner described in subsection 9(1), and the complainant personal information provided to her.
  
• As this had not been done, and instead the complainant was denied access to the entire document, the Assistant Commissioner determined that the insurance company had denied the complainant access to her personal information, contrary to Principle 4.9.

The Assistant Commissioner concluded that the complaint was well-founded.

I have some questions about this that are not dealt with in the published finding. First, it refers simply to the "statement of claim". If it is a statement of claim filed in a lawsuit, it's a public document that the complainant can get in other ways and you can likely imply consent to its disclosure. Secondly, and perhaps more importantly, is that the finding does not address any aspects of agency between the insurer and the insured. The insurer is simply the agent of the insured. The information collected and held by the insurer is done on the behalf of the insured. Using principles of agency, the information (arguably) is constructively held by the insured herself. The insured would have the ability and right to that information under agency principles, regardless of PIPEDA. I don't know if this argument was ever raised before the Assistant Commissioner, but I'd be interested to see whether it would fly.

PIPEDA Case Summary 310: Commissioner initiated complaints against Internet pharmacies

The Office of the Privacy Commissioner has just released the summary of a new finding. This is the first time that I can remember where the complainants have asked to remain anonymous and the Commissioner proceeded to initiate a complaint of her own accord, as is provided for under PIPEDA. In this case, a number of residents of the United States complained that a Canadian-based internet pharmacy had unlawfully disclosed their personal information without consent to two American companies, who used the information without consent. The disclosure, which was by unauthorized employee activity, took place before 2004 and the Assistant Commissioner concluded she was without jurisdiction to issue a finding in that regard. Though the companies that acquired the lists did so without notice that it was purloined, the use was still without consent and the Assistant Commissioner concluded that portion of the complaint was well founded. Read the full finding on the Commissioner's website here: PIPEDA Case Summary #310: Commissioner initiated complaints against Internet pharmacies.