Openness

August 2015

One of the Commissioner’s primary roles is to investigate and try to resolve privacy complaints against organizations. The Commissioner’s findings will depend on the facts of each case and will be informed by the evolving jurisprudence. Over time, findings on certain key issues crystallize into general principles that can serve as helpful guidance for organizations.

In an effort to summarize the general principles that have emerged from court decisions and the Commissioner’s findings to date, the OPC issues Interpretation Bulletins on certain key concepts in PIPEDA. These Interpretation Bulletins are not binding legal interpretations, but rather, are intended as a guide for compliance with PIPEDA. As the Commissioner issues more findings, and the courts render more decisions, these Interpretation Bulletins may evolve and be further refined over time.

I. Relevant Statutory Provisions

Principle 4.8:  “An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.”

Principle 4.8.1: “Organizations shall be open about their policies and practices with respect to the management of personal information. Individuals shall be able to acquire information about an organization's policies and practices without unreasonable effort. This information shall be made available in a form that is generally understandable”.

Principle 4.8.2:  “The information made available shall include
(a) the name or title, and the address, of the person who is accountable for the organization's policies and practices and to whom complaints or inquiries can be forwarded;
(b) the means of gaining access to personal information held by the organization;
(c) a description of the type of personal information held by the organization, including a general account of its use;
(d) a copy of any brochures or other information that explain the organization's policies, standards, or codes; and
(e) what personal information is made available to related organizations (e.g., subsidiaries).”

Principle 4.8.3: “An organization may make information on its policies and practices available in a variety of ways. The method chosen depends on the nature of its business and other considerations. For example, an organization may choose to make brochures available in its place of business, mail information to its customers, provide online access, or establish a toll-free telephone number”.

Principle 4.2.1: “The organization shall document the purposes for which personal information is collected in order to comply with the Openness principle (Clause 4.8) and the Individual Access principle (Clause 4.9)”.

Principle 4.4.1:  “Organizations shall not collect personal information indiscriminately. Both the amount and the type of information collected shall be limited to that which is necessary to fulfil the purposes identified. Organizations shall specify the type of information collected as part of their information-handling policies and practices, in accordance with the Openness principle (Clause 4.8)”.

II. General Interpretations by the Courts

Organizations may meet the requirement for openness through the availability of brochures and tools about their privacy practices. In many cases, these materials may only be available after collection or use of personal information, and therefore cannot be relied on for knowledge and consent. However, if customers are aware of the materials at the time they subscribe for a company’s services, this “openness” can lead to a finding of implied consent.

Englander v TELUS Communications Inc (FCA) 2004 FCA 387, [2005] 2 FCR 572

III. Application by the OPC in Different Contexts

Whether an organization can be said to meet its openness obligations under PIPEDA will vary depending on the facts of each complaint and investigation. The following examples illustrate how the openness principle has been interpreted and applied by the OPC and some of its general findings derived from different contexts.

Availability

Accessibility

Clarity

Inclusion of Contact Information

Publicly Available Information

Information Shared with Other Organizations

Date modified: