Job Seeker Not Adequately Informed about Purpose of Personal Information Collection

PIPEDA Report of Findings #2012-003

---

The complainant was contacted via email by an industry associate of a Toronto-based company operating under the name of “Job Success”. Having obtained a copy of the complainant’s resume from an on-line job search site, and with a view to ostensibly offering job search and career management services, the associate informed the complainant he could be invited to attend an “interview”.

When the company called to arrange a meeting, the complainant asked for more details, particularly whether it was about a specific job. The staff member organizing the meeting responded that she did not have that information available but that further details would be provided in person.

Having accepted the company’s invitation to meet, the complainant visited the respondent’s office and was introduced to a senior director. Following personal introductions, the senior director began asking the complainant where he was from and where he went to school. He also asked the complainant to elaborate on the professional experiences noted in his resume and to provide information on his career aspirations.

Nearing the end of the meeting, which lasted approximately 45 minutes, the senior director turned to the company’s “selection process” and the purported advantages of working with Job Success (namely, assistance in marketing oneself to prospective employers, obtaining quality interviews, and learning how to conduct oneself in interviews).

Up until this point in the meeting, the complainant was of the impression that the company was conducting a job interview. In this regard, the complainant maintained that he was misled as to the purposes for which his personal information had been collected.

Our investigation focused on the obligation of Job Success to identify the purposes for which personal information was to be collected at or before the time of collection. Under PIPEDA, an organization must document the purposes for which personal information is collected, and specify those purposes to the individual to whom the information belongs.

At the time our investigation was initiated, details of the company’s information management practices were difficult to find. Initially, the company’s website did not have a privacy policy and the purposes for which it was collecting personal information was nowhere to be found.

Not only was the company’s website short on information, Job Success also failed to specify the purposes for which it was collecting personal information prior to its meeting with the complainant.

Over the course of our investigation, we asked the respondent about the lack of information it made publicly available about the company’s services. The company responded that its website was “not informative on purpose” so as to generate curiosity about the company’s affairs, thus encouraging individuals to “come in and sit down”.

In our view, Job Success failed to clearly identify the purposes for which individuals’ personal information was being collected at or before the time of collection.

Furthermore, in so much as the company did not make sufficient efforts to ensure that the complainant was advised of the purposes for which his information was to be used, in a manner that he could reasonably understand, it failed to obtain the meaningful consent of the complainant for the collection and use of his personal information.

In the course of our investigation, Job Success agreed to take corrective action within 90 days of the issuance of our final report. We found the complaint to be well founded and conditionally resolved.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the Act)

1. The complainant has alleged that 2057161 Ontario Inc. (the company or “respondent”) collected his personal information without his meaningful consent. More specifically, the complainant has alleged that the respondent collected his personal information under the pretence of facilitating an employment opportunity, only to later concede (following the collection of that information by way of interview) that the purpose of the meeting had instead been to promote a fee-based career management service. The complainant alleged that he was misled about the purposes for which his information was being collected and that he had not provided consent to the collection of his personal information for the purpose of receiving career management advice.

Summary of Investigation

2. The respondent is a Toronto-based organization engaged in the provision of job search and career management services. The company operates through an Ontario numbered corporation under various brands, most recently “Toronto Pathways”, “Job Success”, and “RDG Careers”.

3. On May 20, 2010, the complainant was contacted via email by a Career Administrator, who presumably obtained a copy of the complainant’s resume, as publicly posted, from an on-line job site. According to the respondent, the Career Administrator in question was not an employee of the company, but rather one of its many industry associates.

4. In her email of May 20, the Career Administrator offered to pass along the complainant’s resume to “people in my organization that work with motivated professionals to find and secure the best position in the area”. In extending the offer to assist in the complainant’s job search, the Career Administrator indicated that the company, if interested, would contact the complainant to schedule a confidential “interview” to further evaluate his skills and to help him find the position and income he was seeking.

5. In response to this invitation, the complainant provided the Career Administrator with an electronic copy of his resume along with a brief covering letter. A “Lead Summary” was also prepared regarding the complainant. Together these documents contained various elements of personal information, including the complainant’s name, home address, email address, telephone number, salary range, work history and career aspirations.

6. On May 25, 2010, further to the submission of his resume and cover letter, the complainant was contacted by a Senior Administrator at “Job Success”. The Senior Administrator notified the complainant that his resumehad been evaluated by one of the company’s career directors, and invited the complainant to attend a meeting in person at the company’s Toronto office.

7. Prior to accepting the invitation, the complainant asked the Senior Administrator for more details about the meeting, in particular, whether the meeting was about a specific job. In response, the Senior Administrator indicated that she did not have that information available but that the career director would provide further details in person.^{Footnote 1}

8. On May 26, 2010, having accepted the Senior Administrator’s invitation to meet, the complainant visited the respondent’s head office and was introduced to a Senior Director employed by “Job Success”. Following greetings and personal introductions, the complainant’s meeting with the respondent is said to have begun with a statement of the purpose of the meeting. That purpose, as supplied by the respondent, is said to have been stated as follows:

Senior Director (“Job Success”): The purpose of our meeting here today is first of all, I’d like to take the time to not only discuss your past professional experiences, but, more importantly at this juncture, your future goals, aspirations and what they currently may be in the work place. It is my responsibility in this office to interview candidates to determine on behalf of my staff whether or not we can be professionally helpful to you. If we can, we will invite you back for a second meeting to show you how. [sic] [Emphasis in original]

9. Following this statement, the Senior Director asked the complainant to begin by speaking a little about himself. During the meeting, the complainant alleges the respondent collected more information about himself, including his marital status and his present income. According to the script of the meeting, the complainant was asked where he was from, where he we went to school, and his first job experience. He was also asked to elaborate on the professional experiences noted in his resume and to provide information on his career aspirations. In soliciting information about the complainant, the Senior Director is said to have taken written notes, asserting that any personal information collected was considered highly confidential. According to the respondent, anything discussed during the meeting was held in strict confidence.

10. Nearing the end of the meeting, which lasted approximately 45 minutes, the Senior Director offered the complainant further information on the company’s “selection process”:

Senior Director (“Job Success”): Let me tell you a little about our selection process. First of all, we have been working with clients like yourself in the Toronto area for many years. We’re international in scope. More importantly, Job Success’s main objective is to identify and support individuals who are open to obtaining better employment results in less time using our professional expertise. [sic]

11. In addition, according to the script, the Senior Director provided information on “why people are coming in to see us”, namely, assistance marketing oneself to prospective employers, obtaining quality interviews and how to conduct oneself in interviews.

12. As the discussion relating to the company’s services ensued, the complainant was told that it did not have any work placements presently available. It is the company’s assertion that it had “determined during the course of the initial meeting on May 26, 2010, not to select the complainant to work with any further.” According to the respondent, it is only if a candidate, after the initial meeting, is viewed as someone the respondent can work with that they are invited to a second “no charge ... strategy marketing proposal meeting” with the respondent. Depending on the outcome of the second meeting, a candidate may choose to engage the services of the respondent for a fee.

13. Up until such time as the respondent’s Senior Director informed the complainant about the respondent’s career management services, the complainant contends that he was of the strict impression that the company was instead conducting a job interview. In this regard, the complainant maintained that he was misled as to the purpose for which his personal information had been collected.

14. In the course of our investigation, we conducted a site visit to the company’s Toronto office.

15. During our site visit to the company’s head office, we spoke primarily with the respondent’s Chief Operating Officer (COO). Despite our initial interest in speaking with the Career Administrator who first contacted the complainant, along with the Senior Director who conducted the first interview, we were advised by the respondent that both individuals were no longer working for the company and that neither party could be reached for information or comment. In representations to our Office on December 19, 2011, following the issuance of our Preliminary Report of Investigations, the company offered to put our Office in touch with both individuals, indicating that there was never any intention to avoid our investigative team. As at the time of drafting this report however, our Office had collected sufficient evidence in support of our findings, such that meetings with the Career Administrator and Senior Director were no longer considered necessary.

Application and Analysis

January 31, 2012

16. In making our determination on the complainant’s allegations, we applied Principles 4.2, 4.2.1, 4.2.3, 4.3, 4.3.2, 4.3.5, 4.8 and 4.8.1 of Schedule 1 of the Act.

17. Principle 4.2 requires an organization to identify the purposes for which personal information is to be collected at or before the time of collection. Under the Act, an organization must document the purposes for which personal information is collected (Principle 4.2.1), and specify those purposes to the individual to whom the information belongs (Principle 4.2.3). In complying with these principles, the Act requires that organizations make readily available to individuals specific information about its policies and practices relating to the management of personal information (Principle 4.8).

18. We also considered Principle 4.3, which requires organizations to obtain the knowledge and consent of an individual for the collection, use or disclosure of personal information. As per Principle 4.3.2, organizations must make a reasonable effort to ensure that individuals are advised of the purposes for which their information will be used. To make consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how their information will be used or disclosed. In obtaining consent, the reasonable expectations of an individual are relevant (Principle 4.3.5).

19. In ascertaining the purposes for which the respondent collects personal information, we first turned to the company’s external website for information on its information handling practices. As stated previously, according to Principle 4.2.1, organizations are required to document the purposes for which personal information is collected in order to comply with the Act’s Openness principle. While the Act does not necessarily require an organization to post those purposes on-line, it does compel an organization to be transparent about its policies and practices with respect to the management of personal information (Principle 4.8.1).

20. Given that the respondent attempts to collect personal information on-line through its “job search evaluation” form, we expected to see some disclosure of the company’s policies and practices with respect to the handling of personal information on its external websites. At the time our investigation was initiated, information pertaining to the company’s information management practices was difficult to find. In particular, the Job Success website did not contain a privacy policy. While the company appears to have since posted a privacy policy to the site, the policy and the policies on its other sites fall short of the disclosures required under the Act.

21. As publicly stated, the company’s corporate objective is to “identify and support individuals who are open to obtaining better results in less time using [the company’s] professional expertise”. As described on the respondent’s “Toronto Job Success” site (last accessed August 11, 2011), the company “interviews those specialized individuals who possess the unique qualities and skills that any employer seeks in a valuable team member”. The respondent does not provide any more specific information on its website with respect to how the company identifies and supports job seekers or the purposes for which it collects personal information.

22. For employers, the respondent is said to maintain “an up-to-date and comprehensive database comprised of talented candidates, personally selected and supported by expert industry staff members”. According to the respondent, the company acts as “a key connection for [an employer’s] hiring process, going above and beyond to pre-qualify and prepare every prospect for [that company], using [a] rigorous 'live' evaluation system”.

23. If the respondent’s websites are short on information pertaining to the company’s services and the use of personal information they collect, individuals invited to meet with the company are, in our view, left equally wanting. In the case at hand, the respondent appears to have failed to adequately advise the complainant of the purposes for which his personal information was being collected, despite the numerous opportunities the company had to do so.

24. When the complainant was initially contacted by a Career Administrator via email, the Administrator offered to pass the complainant’s resume along “to people within my organization.” The administrator agent indicated that the company, if interested, would contact the complainant to schedule a “confidential interview” to further evaluate his skills and to help him find a position. In our view, the email failed to clearly state the purposes for which the respondent was collecting the complainant’s personal information. In particular, the language used in the email could lead to an impression that the “confidential interview” related to a specific job opportunity.

25. The respondent also failed to specify the purposes for the collection of personal information prior to conducting the meeting with the complainant. Under Principle 4.3.2, the respondent was under an obligation to make reasonable efforts to ensure that the complainant was advised of the purposes for which it was collecting information. Such an opportunity arose both at the time the complainant was contacted by phone, and at the time the interview was undertaken.

26. In the first instance, not only did the respondent’s Senior Administrator fail to notify the complainant as to the purposes of the meeting (and therein the purposes for collecting his personal information), she appeared in our view to mislead the complainant, suggesting that she did not have information pertaining to the meeting available.

27. We find it hard to believe that the Senior Administrator for the respondent would be unable to respond to the most basic questions relating to the purpose of the meeting she was charged with arranging. As per Principle 4.2.5, persons collecting personal information should be able to explain to individuals the purposes for which the information is being collected. Instead, as alluded to in the respondent’s standard interview script, employees are instructed to remain vague as to the purposes of collection. In response to questions from individuals such as “how did you get my resume” or “is this about a specific job,” the respondent instructs its employees to reply: “I don’t have all those details available here... The Director prefers to meet with you.”

28. Furthermore, the description of the purpose of the meeting which, according to the script and quoted above at paragraph 8, occurs at the outset of the meeting is also vague and does not rectify the lack of information that was provided to the complainant up to that point. Although the purposes for the collection of the complainant’s personal information were ultimately revealed at the parties’ May 26, 2010 meeting, the disclosure appears to have occurred at the meeting’s very end, and well after the collection of the complainant’s personal information. Whereas Principle 4.2.3 requires that the purposes for collection be specified at or before the time of collection, this practice sits squarely in violation of the Act.

29. Although the respondent vigorously denies ever having made reference to an actual job opening in its communications with the complainant, its failure to be plain and clear about the nature of its services appears to have left the complainant with the impression that he was supplying his personal information for the purposes of securing a job.

30. Over the course of our investigation we asked the respondent’s COO about the lack of information it made publicly available regarding the company’s services. To our question, the company’s COO responded that the company’s website is “not informative on purpose” so as to generate curiosity about the company’s affairs, thus encouraging individuals to “come in and sit down.”

31. In our view, the company failed to clearly identify the purposes for which the complainant’s personal information was to be collected at or before the time of collection. Furthermore, in so much as the respondent did not, in our view, make sufficient efforts to ensure that the complainant was advised of the purposes for which his information was to be used in a manner that the individual could reasonably understand, it failed to obtain the meaningful consent of the complainant for the collection and use of his personal information.

32. Finally, the company, at the time of our investigation, did not make readily available to the complainant specific information about its policies and practices relating to the management of personal information and therefore failed to comply with Principle 4.8 regarding openness.

Recommendations

33. In a Preliminary Report of Investigation, our Office made several recommendations to assist the respondent in improving its privacy practices. In particular, we recommended that:

• As per the complainant’s request, the respondent take proper measures to ensure that the complainant’s personal information is destroyed or erased in a secure manner, to the extent permitted by law;
• The respondent make readily available to individuals specific information about its policies and practices relating to the management of personal information, in keeping with Principle 4.8. To this end, we recommended that the company correct deficiencies in the company’s various privacy policies and make such policies readily available on-line. Under Principle 4.8.2, organizations must make at minimum the following information available:
  • The name or title, and the address, of the person who is accountable for the organization’s policies and practices and to whom complaints or inquiries can be forwarded;
  • The means of gaining access to personal information held by the organization;
  • A description of the type of personal information held by the organization, including a general account of its use;
  • A copy of any brochures or other information that explain the organization’s policies, standards, or codes; and
  • A description of personal information made available to related organizations (e.g., subsidiaries).
• The respondent hereafter identify, document and specify the purposes for which it collects personal information, at or before the time the personal information is collected. While, under Principle 4.2.4, these purposes can be specified orally or in writing, given the manner in which personal information is being collected, we believe that a written agreement or consent form, would best provide notice of the purposes for which the company is collecting and using personal information; and
• The respondent improve its communications (e.g., initial emails, scripts, etc.) to prospective customers to clearly indicate:
  • the nature of services provided by the company, along with a description of what such services entail;
  • the purpose of the initial meeting with a potential customer; and
  • that initial meetings with potential candidates are not in relation to a specific job opportunity and thus not a “job interview” per se.

In our view, the above information should be provided in communications to all customers, in particular at the outset of any activity in which personal information is being collected.

The Respondent’s response to the recommendations

34. In response to our Preliminary Report of Investigation, the respondent maintained that the purpose of the initial meeting was clearly identified to the complainant by the Career Administrator, the Senior Administrator and by the Senior Director at the outset of the in-person meeting. The respondent submitted that it was not responsible if the complainant formed the mistaken impression that the meeting was a “job interview”.

35. The respondent stated that the Career Administrator was not acting on behalf of the respondent and that the respondent had no control over what the Career Administrator said in her initial email to the complainant. Nevertheless, the fact remains that the respondent collected the complainant’s resume and cover letter via the Career Administrator. The respondent was therefore responsible, pursuant to Principle 4.2.3, for ensuring that the purpose for which the information was being collected was specified to the complainant at or before the time of the collection.

36. The respondent also argued that since the complainant’s resume was publicly available it had implied consent to collect it. However, while the complainant – by posting his resume on a job website – may have given his implied consent for potential employers to review his resume and contact him, the respondent was not in this instance a potential employer. In any event, the respondent collected more personal information from the complainant than what was found in his resume, including information in the Lead Summary, the complainant’s cover letter, as well as the information provided by the complainant in the in-person meeting. The respondent was required to obtain informed consent for the collection of this information as well.

37. With respect to the complainant’s conversation with the Senior Administrator, the respondent maintained that the Senior Administrator is simply booking an appointment and does not have sufficient information to answer specific questions about the content or purpose of the meeting. However, by the respondent’s own admission, the initial meetings it conducts with candidates follows a standard script and serves to determine whether the respondent will invite the candidate to return for a second “strategy marketing proposal meeting”. According to the respondent, it is not meant to discuss a specific job opportunity. In other words, the general purpose of the initial meeting does not vary from candidate to candidate. Given this, it is difficult to see why the Senior Administrator could not provide more detailed information to candidates about the purpose of these types of meetings, and, in particular, why she could not be forthright that the purpose of the meeting is not to discuss a specific job opportunity.

Conclusion

38. Notwithstanding its submissions, the respondent ultimately agreed to implement all of our recommendations. In particular, the respondent confirmed that it had securely destroyed the complainant’s personal information. We understand that fully implementing the remainder of the recommendations may take time. Accordingly, the respondent has agreed to fully implement these recommendations and to demonstrate to our Office their implementation within 90 days from the date of this report.

39. Our Office has a continuing interest in ensuring that the respondent adopts the measures needed to bring it into compliance with PIPEDA and follows through on the express commitments it has made to the Office in this regard. As such, we will be monitoring and reviewing the corrective actions the respondent has committed to undertake and demonstrate to us pursuant to the agreed upon timeframe. At such time, we will gauge whether the respondent has fully complied with the recommendations and, if necessary, we will address any outstanding concerns in accordance with our authorities under the Act.

40. Accordingly, we find the complaint to be well-founded and conditionally resolved with respect to the matters of identifying purposes, consent and openness.