Internet posting violates PIPEDA

PIPEDA Case Summary #2005-305

(Principles 4.3)

Complaints

An individual complained that the owner of a dog breeding business posted the complainant's personal information on the owner's business web site, without consent.

Summary of Investigation

The complainant and the dog breeder had been involved in a lengthy dispute over the ownership of a particular dog. When the complainant noticed her and her spouse's personal information, namely, their names, address, telephone and facsimile numbers, and picture, posted on the breeder's web site, she complained to the Office.

At the Office's intervention, the breeder removed the information from her web site. However, some time later, the complainant alleged that new information about the complainant's spouse was posted on the breeder's site. Again, at our request, the breeder removed the information.

Findings

Issued February 4, 2005

Jurisdiction: January 1, 2004, the Personal Information Protection and Electronic Documents Act (Act) applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities. The Commissioner had jurisdiction in this case because the web site in question serves as an advertisement for a business whose purpose is to sell dogs, and is therefore a commercial activity.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

The Assistant Privacy Commissioner noted that there was no question that the breeder had posted the complainant's and her husband's personal information on her company web site, without consent, and contrary to Principle 4.3.

She therefore concluded that the complaint was well-founded.

Further Considerations

While the Assistant Commissioner was pleased that the breeder removed the information, she was concerned that the breeder may post the information again, in the future. She therefore recommended that the breeder refrain from posting any individual's personal information on her company web site, without first obtaining the individual's consent.