Notes from phone calls with the Privacy Commision’s investigator

Between 2004.06.01 and 2005.03.31, I spoke on the phone with an investigator from the Privacy Commissioner’s office three times. What follows are lightly-edited notes from those calls. As the investigator is not a public figure, it is not necessary to name her in any of these documents.

2004.06.01 11:50

“It is not contrary to the Act for them to request personal information in exchange for equipment.” Such is the initial finding based on precedent (she brought up the case of returning an item to a store). I said it wasn't the complainant's responsibility to solve the respondent's problem, but she explained that, in the lengthy give-and-take in this investigation, I could make “representations” at any time, which would be weighed by the Commissioner.

She wrote to Famous Players stating the complaint came from “Joe Clark, Toronto.” She asked about:

• the fact that I alleged on these four dates that personal information was collected
• retention policies and consistency
• training

If the Commission deems the information insufficient, they can launch their own 60-day investigation, including interviews with the people involved in the incidents and, possibly, visits to theatres. (She claimed she'd already been to the Ottawa ones, plural. She also spends several weeks per month in Toronto on bank complaints.)

FP would have to make my file available in a form understandable to me, which could in fact mean at their office at a certain time on a certain screen.

FP will provide a written response within the first full week of July. And she'll be on vacation till at least July 20.

There was the usual bullshit about how “angry” I was and whether the Office and I could even “work together.” I told her that Commission staff have to recognize they're dealing with people with pent-up frustrations and that they should not take it personally.

2004.06.23 16:21

Famous asked for an extension till August 31. And, curiously, this delay has been “accepted.”

My complaint was accepted as such May 4. The Commissioner has until 20050504 to render a decision, and they wouldn't consider it “delayed” until January or February.

We then had the usual bullshit conversation about tone of voice, which I told her we'd already covered. I asked twice if there was any other substantive news, and on the second request she said no.

“Well, I'm not going to get in a war of words with you. I'll just note your comments in the file.”

2005.03.31 15:46

Investigation was completed, the report is done, and it’s going to the assistant commissioner. Called to do a review of facts.

Upon review of further facts gained; notes from our calls; and [information from] Famous Players, she added [as grounds for complaint] openness and retention to collection; safeguards; openness and accountability (training in the 20040601 notes).

First they dealt with the background, “basically outlined what you specifically indicated in your complaint.”

• Collection: Asked FP why they collect it; answer was “it is their equipment; they purchased it... it is a valuable item to them. As a result, they want to track the item... Accountability,” she said. She says they don’t have to point out any incidence of loss or theft. Commissioner looked at whether or not it was reasonable to collect information, and (inevitably) “the recommendation was that it is reasonable to collect that information.” (Assistant commissioner will likely adjudicate.)
• Safeguards: Their determination was that they did fail to safeguard the information. “Recommendation is that the complaint would be well-founded in that respect.”
• Accountability: Asked many times if they knew of PIPEDA. Also talked to GM about whether their publication of a policy on their site required him to collect ID. “The facts indicate that there certainly was some confusion around the accoutability. Some people were aware of the privacy policy; some were not.” Not everyone has to be aware with PIPEDA per se, but “we would ask that people are aware that there is an act concerning privacy” and that customers could be sent to a knowledgeable person or to the policy itself. Recommendation: “Determine that the complaint is well-founded, because I believe that there was a lack of accountability.”
• Openness: Available on Internet. Investigation determined that they have a privacy policy on the Web, and (“and we did some testing on this”) they have copies available. Company has now undertaken to have a copy of the policy at each site. Also “have portions read to them – whatever they needed.” “We had some... interesting discussion on that as to whether it met the test.” Recommendation: Complaint is not well-founded. Those discussions were with [the director-general] of investigations and legal counsel. They do not ever look at “accessible to people with disabilities.” (Apparently you had to phone the privacy officer. Alternate formats would be provided on request. There was no evidence to the contrary that it was not available by phoning up and asking.) They wondered if they had jurisdiction to deal with accessibility; “some of the issues that we address may not necessarily encompass all the issues that you feel need to be addressed, but we dealt with those that we feel we have jurisdiction over.”
• Retention: I didn’t word it as a retention issue, but I brought it up in our phone calls “and I felt that it should be addressed, so I went ahead and looked at it.” “I also type when you speak and I decided to run with that”: my quote of “I don’t even know what they do with it.” Throwing out such slips [of paper] is an issue she feels should be generally addressed. “I don’t feel that they’ve properly addressed it,” but they will record it now; “they must ask for corroborating identification... and the Commission agrees with that”; on leaving, you are given the sheet with your information back. ID produced is only for verifying the name; cannot record the type of information (e.g., address, card number). “That’s a reasonable business practice; we agree with that” to confirm ID, but there is no reason to retain the information.

Heather Black is the deputy commissioner, but the file goes from her to Legal for a final review, then to Black or Jennifer Stoddart. “If you decide that you want to publish the finding on your Web page, you may do so.”

May 4 is the year mark from the date the complaint was accepted, so she hopes I’d have a response before then. They’re dealing with cases from Jan./Dec./Feb., she thinks.