| View previous topic :: View next topic |
| Author |
Message |
Sanchex
Joined: 08 Mar 2008
Posts: 50
Location: Toronto
|
 Posted: Tue Feb 02, 2010 12:49 pm Post subject: Violation of Privacy by LCBO? |
 |
|
| For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO? |
|
| Back to top |
|
 |
JesseMcG
Joined: 24 Sep 2008
Posts: 207
|
| Posted: Tue Feb 02, 2010 12:55 pm Post subject: |
|
|
| I noticed that as well... not sure I feel great about it. |
|
| Back to top |
|
|
inertiaboy
Joined: 12 Apr 2004
Posts: 534
Location: Steve, Ottawa West
|
| Posted: Tue Feb 02, 2010 12:56 pm Post subject: Re: Violation of Privacy by LCBO? |
|
|
| Sanchex wrote: | | For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO? |
Initially, yes. After some thought, double-yes. |
|
| Back to top |
|
|
inertiaboy
Joined: 12 Apr 2004
Posts: 534
Location: Steve, Ottawa West
|
| Posted: Tue Feb 02, 2010 1:05 pm Post subject: |
|
|
| LCBO Privacy Policy. I'm pretty sure that this disclosure does not fall under their stated disclosure policy. |
|
| Back to top |
|
|
Spab
Joined: 15 Jun 2009
Posts: 24
Location: Toronto
|
| Posted: Tue Feb 02, 2010 3:45 pm Post subject: |
|
|
| Sanchex wrote: | | For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO? |
I certainly could have done without it.
Re: their stated policy: I'm not sure my e-mail address would constitute "personal information" for the purposes of the LCBO's Privacy Policy and Security Statement (which I assume is meant to refer to the defined term in the Freedom of Information and Protection of Privacy Act, i.e. "recorded information about an identifiable individual, including..."), however, folks with e-mail address of the FirstName.LastName@URL.com variety would appear to have a definite gripe on that basis. Nonetheless it does seem pretty unimpressive and unprofessional particularly by a large, fairly sophisticated organization and would seem contrary to the spirit of their policy and FIPPA if not the letter of them.
I'll confess, I'm not entirely surprised by this. It certainly appeared to me from my involvement in the order that the LCBO was ignoring FIPPA in how it handles private orders in general. Subsection 38(2) of FIPPA states: "No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity." The LCBO has no express statutory authorization and this is not a law enforcement issue. While the order is presumably a lawfully authorized activity, what personal information is truly necessary to its proper administration (necessary that is for the LCBO's purposes, not for Cass' or whoever is organizing a particular order)? I would have thought no more than a name, credit card information (for a deposit if being paid by credit card) and an inspection of one's ID when picking up the order.
Perhaps there might be arguments on the other side (like the argument that collection of address, phone numbers, etc is necessary to defer fraud as here: http://www.ipc.on.ca/images/Findings/pc07-100-lcbo_374308213204.pdf). I don't see it. But even if the collection is authorized under s. 38(2) there's also the manner of collection. Subsection 39(1) of FIPPA states:
39. (1) Personal information shall only be collected by an institution directly from the individual to whom the information relates unless,
(a) the individual authorizes another manner of collection;
(b) the personal information may be disclosed to the institution concerned under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act;
(c) the Commissioner has authorized the manner of collection under clause 59 (c);
(d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act;
(e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service;
(f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or tribunal;
(g) the information is collected for the purpose of law enforcement; or
(h) another manner of collection is authorized by or under a statute.
Unless you call being required to fill out forms and submit them to the person organizing an order "authorizing another manner of collection" (and I certainly wouldn't) then the LCBO's collection of personal information on private orders would appear to violate s. 39(2). Of course, all of us probably trust Cass with our information more than the LCBO (as this episode has shown). But the fact that the way a private order works is necessarily submitting your personal information to someone organizing an order and that person in turn submitting all of it to the LCBO is inappropriate.
All this is to say I'm not surprised by the LCBO's questionable move in this particular instance, but to me their lack of regard for personal privacy and privacy laws were already in evidence. It is certainly open to complain to the LCBO's Freedom of Information and Protection of Privacy Office (listed at the bottom of their Privacy Statement) or the Information and Privacy Commissioner (http://www.ipc.on.ca/images/Resources/cmpfrm-e.pdf). My concern has always been though, won't the ultimate outcome just be for the LCBO to make it harder (impossible?) to do private orders?
All in all another reason to love the LCBO. |
|
| Back to top |
|
|
jaymack
Joined: 29 Sep 2005
Posts: 289
|
| Posted: Tue Feb 02, 2010 5:27 pm Post subject: |
|
|
| In short... no. |
|
| Back to top |
|
|
hops are your friend
Joined: 03 Sep 2006
Posts: 46
Location: Ottawa
|
| Posted: Tue Feb 02, 2010 11:02 pm Post subject: |
|
|
| Obviously they should have used bcc to send this email out, but they didn't. Many people make that mistake. I would suggest sending an email back to the sender to remind them of the 'proper' way to do this. |
|
| Back to top |
|
|
inertiaboy
Joined: 12 Apr 2004
Posts: 534
Location: Steve, Ottawa West
|
| Posted: Wed Feb 03, 2010 8:46 am Post subject: |
|
|
| hops are your friend wrote: | | Obviously they should have used bcc to send this email out, but they didn't. Many people make that mistake. I would suggest sending an email back to the sender to remind them of the 'proper' way to do this. |
I did that and she thought she had used the BCC until I told her. 90% of errors are because of the system and not the person and this is probably one of them. |
|
| Back to top |
|
|
Derek
Joined: 22 Oct 2004
Posts: 1678
Location: Kelowna, BC
|
| Posted: Wed Feb 03, 2010 10:20 am Post subject: |
|
|
Hmmm... perhaps I shouldn't have used my work email address, but my only real concern is the potential for spam.
If I was the importer (Cass), I'd be seriously pissed off that Cecktor's list of clients was just revealed. There's at least one other importer (that could potentially be a competitor) on that list. Maybe not an issue here, but it could potentially be a BIG issue. |
|
| Back to top |
|
|
kwjd
Joined: 17 Jun 2009
Posts: 374
Location: Toronto
|
| Posted: Wed Feb 03, 2010 10:34 am Post subject: |
|
|
I'm annoyed because my e-mail address was given out without my permission. Practically though, I don't care that my e-mail address is known to people on this order.
It is probably just the mistake of one employee that wasn't thinking rather than a company wide failure. |
|
| Back to top |
|
|
SteelbackGuy
Joined: 06 Feb 2005
Posts: 3032
Location: London, ON
|
| Posted: Wed Feb 03, 2010 10:36 am Post subject: |
|
|
| kwjd wrote: | I'm annoyed because my e-mail address was given out without my permission. Practically though, I don't care that my e-mail address is known to people on this order.
It is probably just the mistake of one employee that wasn't thinking rather than a company wide failure. |
I would hazard a guess that you are probably right. And as we all know, no member of this forum has ever made a mistake at work.........ever.
Best to still look into it though.
_________________
Uncle Len gets the job done every time. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
