Employment and Social Development Canada collects personal information again despite the complainant’s previous objection

Complaint under the Privacy Act (the Act)

March 28, 2019

1. The complainant alleges that Employment and Social Development Canada (ESDC) contravened provisions of the Act when it collected, for a second time and despite his opposition, his name, telephone number and email address through Grey House Publishing Canada company (Grey House) as part of the Prime Minister’s Volunteer Awards.
2. The complainant also filed a complaint against Grey House under the Personal Information Protection and Electronic Documents Act (PIPEDA) for having collected and disclosed his personal information to ESDC. This complaint is the subject of our office’s separate investigation.

Background

3. The complainant’s name, email address and telephone number appear on the website of a social club intended for the learning, use and promotion of an international language (the club).
4. At the time of the incident, ESDC was administering the Prime Minister’s Volunteer Awards program (now called Canada’s Volunteer Award Program^{Footnote 1}). According to ESDC, this program is intended to highlight the important contributions of volunteers, innovative not-for-profit organizations and leading-edge businesses to their community through volunteering and innovative ideas approaches for tackling social problems.
5. Grey House is a private business, established in 2006, that develops and publishes information products in the areas of business, health, statistics and demographic data. It is also a database editor whose directories supply data for libraries, businesses and Canadian government statistical, demographic and other data offices.
6. ESDC used the services of Grey House “with the aim of buying a list of contact information in order to target an audience that met ESDC’s specific needs” and with the ultimate goal of “obtaining a distribution list [in order to] electronically promote (via email) the call for nominations for the Prime Minister’s Volunteer Awards, which takes place every year.”

Summary of the investigation

7. The investigation revealed that, on May 1, 2015, the complainant received an email from ESDC, informing him that ESDC “was accepting nominations for the Prime Minister’s Volunteer Awards until June 30, 2015.” The complainant said that he had never expressed an interest in this award and not consented to the collection of his personal information, which, moreover, had been obtained through a third party rather than directly from him. The complainant also said that in the past, he had asked ESDC to remove his name from the distribution list for this award when he had received similar correspondence in 2014.
8. In his complaint, the complainant explains that his name, telephone number and email address are personal information. The fact that this information appears on a website stating that he is the contact person for a club does not make this information accessible to the public within the meaning of the Act and associated regulations, and does not mean that this personal information can be collected and communicated.
9. The complainant attached to his complaint a letter from Grey House in reply to his questions. Grey House explained that it publishes business information concerning people and not personal information. Grey House concluded by referring the complainant to the website concerned that identified him as a contact person and contains the complainant’s personal information.
10. The complainant stated that he was not listed as an executive, director or employee and did not hold a position of responsibility with regard to the club. He said that the information on the list provided to ESDC by Grey House therefore could not constitute business contact information.
11. In response to the allegations, ESDC explained that the name, email address and telephone number associated with the complainant were obtained through Grey House.
12. ESDC believes “that it did not collect the complainant’s personal information without authorization.” According to ESDC, “the contract clearly stated Grey House’s responsibility to provide lists in accordance with Canadian legislation and that all the necessary consents and agreements had to be in place to access email addresses.” ESDC believes that it “acquired the distribution list in a compliant manner.” ESDC also said that its use was directly related to one of its programs, i.e. administering the Prime Minister’s Volunteer Awards.
13. ESDC acknowledges also having received, in 2014, the request from the complainant to remove his name from the distribution list. ESDC explained that it receives a new distribution list each year, but had no mechanism in place to ensure that the names and addresses of individuals from previous years, who no longer wanted to be on the list, were removed from future lists.
14. In our investigation pursuant to the PIPEDA, we concluded that Grey House had collected the complainant’s personal information without his consent and in a manner contrary to the PIPEDA. In particular, we concluded that the complainant’s personal information was not business contact information and that there were no other applicable exceptions to the requirement to obtain consent. In response to the complaint, Grey House agreed to delete the complainant’s information from its databases.

Application

15. In making our determination, we took into account both the spirit and the letter of the Act, in particular sections 3, 4 and 5. We also took into consideration the terms of the contract between ESDC and Grey House.
16. Section 3 of the Act defines personal information about an identifiable individual that is recorded in any form, particularly information relating to race, national or ethnic origin, colour, religion, age, marital status, education, criminal or employment history, identifying numbers, fingerprints, blood type, personal views, etc.
17. The complainant’s name, telephone number and email address, insofar as it is his personal contact information made available to the club, of which he is a member, constitute personal information under the Act.
18. Section 4 of the Act allows federal institutions to collect only personal information directly related to their programs or activities.
19. Section 5 of the Act states that a federal institution shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where the individual authorizes otherwise, or where personal information may be disclosed to the institution under subsection 8(2). Section 3 states that administrative purposes in relation to the use of personal information about an individual, means the use of that information in a decision making process that directly affects that individual.
20. We believe that ESDC was not required to collect the personal information concerned directly from the complainant. Section 5 of the Act only imposes such an obligation when the personal information is intended for administrative purposes. In this case, the personal information collected was not intended for the purposes of a decision directly affecting the complainant.
21. Nonetheless, we believe that ESDC did not comply with section 4 of the Act. Section 4 requires that the collection of personal information be done while respecting the limits established for the program or activity of a federal institution concerned. In other words, a federal institution may not collect personal information that exceeds the framework of a program or activity.
22. Although ESDC had collected the complainant’s personal information with the objective of promoting the Prime Minister’s Volunteer Awards, ESDC had clearly indicated that its promotion of the campaign was limited to contact information that had been obtained with all necessary consent and in accordance with the Act. In particular, the contract with Grey House required that the lists obtained be “in accordance with Canadian legislation” and that “all the necessary consents and agreements be in place”. We found that Grey House had obtained the complainant’s personal information without the complainant’s consent, in contravention of PIPEDA, and in a manner violating the terms of the contract and thus the parameters that ESDC had established for its promotion program.
23. We believe that it was not sufficient for ESDC to establish the contractual requirements with Grey House; it was ESDC’s responsibility to ensure that Grey House complied with the terms of the contract related to its responsibilities under the Act.
24. Moreover, ESDC continued to collect and use the complainant’s personal information despite his express request to be removed from the list and not to be considered as part of the program.
25. In short, the collection of the complainant’s personal information did not comply with the terms and conditions of the program promoting the Prime Minister’s Volunteer Awards. ESDC therefore failed to fulfil its obligations under section 4 of the Act.

Conclusions

26. We do not believe in this case that ESDC complied with the Act’s requirements regarding the collection of personal information. By including the need for consent in the contract, ESDC imposed on itself the obligation to obtain the complainant’s consent as part of the collection of personal information. Moreover, ESDC collected the complainant’s information a second time despite the latter’s clearly expressed refusal to participate in the program.
27. In the light of the foregoing, it is our conclusion that the matter is well-founded.

Other

28. However, we are satisfied that, following this complaint, ESDC made changes to its procedures. Now it verifies the new distribution lists that it receives to ensure that the names of individuals who no longer wish to receive emails about the Prime Minister’s Volunteer Awards program are removed.
29. Moreover, we recommend that ESDC ensure that the third parties with which it has agreements comply with the terms of the contract related to their responsibilities under the Act.