Privacy Commissioner faults two summer camps for exchanging information about camper

In two related complaints against two summer camps, the Assistant Privacy Commissioner of Canada faulted the camps for exchanging information about a camp applicant without adequate consent. In PIPEDA Report of Findings #2012-007, the parent of a prospective camper complained to the Office of the Privacy Commissioner of Canada because the camp contacted another summer camp that the child had attended previously. The camp in question first stated that they had not contacted the second camp at all, but exchanging such background information was relatively standard in their business and, if they had, they would have had adequate consent by virtue of their privacy policy and privacy statement that was available to the complainant.  

In speaking with the second camp, the Assistant Commissioner determined that the exchange of background information had taken place, notwithstanding the company’s initial statements. With respect to adequate consent, the Assistant Commissioner reviewed the relevant privacy statements and concluded they were too vague and uncertain to result in consent for this sort of information collection. The Assistant Commissioner recommended that the camp obtain better consent for such collections and uses of personal information, and provide privacy training to employees. The recommendations were accepted and the complaint was determined to be “well founded and conditionally resolved”.

With respect to the second summer camp, which had disclosed information to the first summer camp, the Assistant Commissioner found that it violated PIPEDA in PIPEDA Report of Findings # 2012-008.  Specifically, the complainant alleged that it had disclosed the former camper’s personal information without consent. The camp admitted that it had disclosed the information, but stated it was a standard practice and that adequate consent had been obtained. The Assistant Commissioner examined the camp’s privacy statements and concluded the information was minimal and not a sufficient basis for consent.

The Assistant Commissioner concluded that the complaint was “well founded and conditionally resolved”, as the camp agreed to follow her recommendations to implement a better policy and to provide employee privacy training.