CIPP/C Cases with Answers

"SWIFT" OPC-initiated Complaint v. SWIFT - Answer-OPC PIPEDA applied: SWIFT had a "significant presence" in Canada; Vast majority of international transfers of PI utilized the SWIFT network. Orgs like SWIFT are allowed, via PIPEDA, to disclose w/out consent - legitimate laws of other countries. 2006 "SWIFT" Individual Complaint v. 6 Canadian FIs - Answer-OPC PIPEDA applied: SWIFT had a "significant presence" in Canada; Vast majority of international transfers of PI utilized the SWIFT network. SWIFT clearly disclosed their practices - consent. TJX - Answer-OPC and IPC Alberta US-based retail corp (FI and Identifiers crossborder) PIPEDA and Albert PIPA applied: Reasonable Safeguards were not met; Driver's License collection was unreasonable; Storing of PI indefinitely is not compliant. 2006 Facebook 2008 - Students at University of Ontario (CIPPIC) - Answer-OPC PIPEDA applied: FB provided PI to 3rd-party app developers without meaningful consent and did not meet notice obligations OPC issued a report in 2009 with recommendations for FB and its 3rd-party developers, in re: knowledge and consent obligations. OPC Facebook Report - Answer-OPC 2009 FB was not meeting the "knowledge and consent" obligations under PIPEDA. OPC issued recommendations: Data collection must be limited to operational necessity; Provide sufficient notice (re: collection and purpose); Meaningful consent necessary for PI transfer Facebook 2019 - Privacy Commissioners of Canada and Alberta Report - Answer-thisisyourdigitallife investigation, post-Cambridge Analytica. Privacy Commissioners revisited FB's "implementation" of 2009 recommendations and made further recommendations for tydl violations: consent was neither valid nor meaningful for FB users or user's friends, safeguards were inadequate, accountability was shifted to the 3rd parties. Nexopia - Answer-OPC (via various complaints) re: social networking site for 13-18 yr. olds, default privacy settings, indefinite data retention, etc. PIPEDA applied: notice, consent, retention, reasonable expectation of use violations. 24 recommendations, including a delete request. A disclosure of PI to the general public was not a reasonable expectation of use. Non-users' PI cannot be retained without consent. Meaningful, valid consent to collect PI must be obtained before registration.