An individual objects to her name and address being sold to third parties

PIPEDA Case Summary #2004-260

[Principles 4.3 and 4.3.2 of Schedule 1]

Complaint

An individual complained that a company from which she had purchased a product sold her name and address to third parties without her consent.

Summary of Investigation

An individual ordered something from a company by telephone. A few months later, she asked the company, in writing, to remove her name from its mailing list. Despite this request, her name was on a list that the company sent to a consultant that it had hired to trade and rent its customer list to other organizations. The company said that its catalogues and the other documents made available to customers stated that customer lists were shared and laid out the procedure for getting one's name removed from the lists. It said that customers were specifically told in this information that their names and addresses would be shared with other businesses.

Findings

Issued February 4, 2004

Jurisdiction: Since January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) has applied to federal businesses. Section 30 of the Act states that the Act applies to any organization in respect of personal information that it collects, uses or discloses within a province if the organization also discloses the information outside the province in return for consideration. Since the individual alleged in her complaint that the business disclosed her information outside the province for consideration, the Assistant Commissioner agreed to accept the complaint and investigate it under the Act.

Application: Principle 4.3 states that the knowledge and consent of an individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2 states that this principle requires "knowledge and consent." Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

As a result of the Office's intervention, the company changed its promotional materials to make them clearer and more understandable. From now on, customers can simply check a box on the purchase order in order to prevent their information being shared. The company also set up a privacy committee in order to ensure that the privacy of both its employees and customers are protected. One committee member will be responsible for protecting privacy within the company. The committee also adopted a policy on the protection of personal information, which will be forwarded to all customers. The privacy committee is also working on a policy to protect the privacy of all the company's employees.

The Office of the Privacy Commissioner determined that, at the time of the complaint, the promotional materials contained a notice stating that customers' names and addresses were shared with third parties and laying out a procedure for being removed from the lists, thus complying with Principle 4.3 of Schedule 1 of the Act. However, the notice and the suggested procedure for being removed from the lists were unclear. The information was hidden away under headings that were not very representative of the contents. This notice did not constitute a reasonable effort by the company to ensure that individuals were clearly informed about the secondary disclosure purposes for which the personal information was collected. The Assistant Commissioner found, therefore, that the consent was not meaningful and the company had contravened Principle 4.3.2 of Schedule 1 of the Act.

Since the individual involved stated that she was satisfied with the fact that her name had been removed from the list and the company had made the necessary changes to its materials, the Assistant Commissioner concluded that the complaint was resolved.

Further Considerations

The Assistant Commissioner congratulated the company on its initiatives in response to the complaint. These initiatives demonstrated the interest that the company took in, and the importance that it attached to, the protection of personal information.