Biron Health Group has ceased sending promotional emails to travellers arriving in Canada who undergo COVID-19 testing

PIPEDA Findings #2022-002

May 10, 2022

---

Complaint under the Personal Information Protection and Electronic Documents Act

Description

The complainant alleges that Biron Health Group (“Biron”) used his email address to send him promotional emails without his consent after he underwent COVID-19 testing upon his arrival at the airport. In the complainant’s opinion, this practice violates the Personal Information Protection and Electronic Documents Act. Biron has since ceased this practice and deleted from its marketing database the email addresses of the travellers concerned.

Takeaways

• Individuals required to undergo COVID-19 testing at the border do not expect the personal information that they provide to the organizations conducting such tests to be subsequently used for promotional purposes.
• Organizations that collect personal information, including sensitive information such as health information as part of a COVID-19 test, must consider these circumstances before they contemplate using the information for secondary purposes, such as for promotional use.

Summary of complaint

Upon his arrival on an international flight at Montreal Trudeau Airport, the complainant was required to undergo COVID-19 testing, conducted by Biron, in accordance with public health rules issued by the Public Health Agency of Canada. The complainant says he provided his email address to Biron for the sole purpose of receiving his test results.

A few days after receiving his test results, the complainant received an email from Biron promoting its other services. The complainant says he used the unsubscribe function within the email and confirms he has received no further unwanted emails. Nevertheless, as he was shocked to receive such an email, the complainant filed a complaint with the OPC.

In the meantime, other individuals contacted Biron to complain and an article denouncing this practice appeared in the media.

Outcome

In response to our questions, Biron explained that it had received a few complaints directly from other travellers and had therefore decided to stop sending promotional emails to travellers arriving in Canada who were not already its clients.

Biron explained to the OPC that it had initially considered that a business relationship had been established with the travellers in question and that it could therefore assume their implicit consent to send them promotional emails.

The OPC is of the opinion that Biron could not reasonably assume that it had the implicit consent of travellers arriving in Canada. Biron was mandated by the government to conduct COVID-19 testing on travellers and paid by the Montreal Trudeau Airport. Biron was the only company offering this service at this airport. Consequently, travellers arriving in Canada had no choice but to do business with Biron to comply with the rules issued by the Public Health Agency. In this situation, these travellers would not normally expect their personal information to be used for reasons other than the mandatory testing.

Biron collected the travellers’ personal information for the purpose of conducting COVID-19 tests and sending them sensitive information related to their health, notably their test results. Biron was acting as a service provider for the airport. The OPC considers that Biron should have taken these circumstances into account before using the personal information for secondary marketing purposes and for its own purposes.

Biron confirmed to the OPC that it had deleted from its marketing database the email addresses of travellers arriving in the country who were not already its clients. Given that Biron has ceased the problematic practice and taken corrective action, and given that the complainant is satisfied with the action that Biron has taken in response to his complaint, the complaint has been deemed settled during the course of the investigation.