Violation of Privacy by LCBO?

[Sanchex]

For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO?

[JesseMcG]

I noticed that as well... not sure I feel great about it.

[inertiaboy]

For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO?

Initially, yes. After some thought, double-yes.

[inertiaboy]

LCBO Privacy Policy. I'm pretty sure that this disclosure does not fall under their stated disclosure policy.

[Spab]

For those in on the Garrison order, are you concerned about having your email sent out to all of the other 57 recipients by the LCBO?

I certainly could have done without it.

Re: their stated policy: I'm not sure my e-mail address would constitute "personal information" for the purposes of the LCBO's Privacy Policy and Security Statement (which I assume is meant to refer to the defined term in the Freedom of Information and Protection of Privacy Act, i.e. "recorded information about an identifiable individual, including..."), however, folks with e-mail address of the FirstName.LastName@URL.com. variety would appear to have a definite gripe on that basis. Nonetheless it does seem pretty unimpressive and unprofessional particularly by a large, fairly sophisticated organization and would seem contrary to the spirit of their policy and FIPPA if not the letter of them.

I'll confess, I'm not entirely surprised by this. It certainly appeared to me from my involvement in the order that the LCBO was ignoring FIPPA in how it handles private orders in general. Subsection 38(2) of FIPPA states: "No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity." The LCBO has no express statutory authorization and this is not a law enforcement issue. While the order is presumably a lawfully authorized activity, what personal information is truly necessary to its proper administration (necessary that is for the LCBO's purposes, not for Cass' or whoever is organizing a particular order)? I would have thought no more than a name, credit card information (for a deposit if being paid by credit card) and an inspection of one's ID when picking up the order.

Perhaps there might be arguments on the other side (like the argument that collection of address, phone numbers, etc is necessary to defer fraud as here: http://www.ipc.on.ca/images/Findings/pc ... 213204.pdf). I don't see it. But even if the collection is authorized under s. 38(2) there's also the manner of collection. Subsection 39(1) of FIPPA states:

39. (1) Personal information shall only be collected by an institution directly from the individual to whom the information relates unless,
(a) the individual authorizes another manner of collection;
(b) the personal information may be disclosed to the institution concerned under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act;
(c) the Commissioner has authorized the manner of collection under clause 59 (c);
(d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act;
(e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service;
(f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or tribunal;
(g) the information is collected for the purpose of law enforcement; or
(h) another manner of collection is authorized by or under a statute.

Unless you call being required to fill out forms and submit them to the person organizing an order "authorizing another manner of collection" (and I certainly wouldn't) then the LCBO's collection of personal information on private orders would appear to violate s. 39(2). Of course, all of us probably trust Cass with our information more than the LCBO (as this episode has shown). But the fact that the way a private order works is necessarily submitting your personal information to someone organizing an order and that person in turn submitting all of it to the LCBO is inappropriate.

All this is to say I'm not surprised by the LCBO's questionable move in this particular instance, but to me their lack of regard for personal privacy and privacy laws were already in evidence. It is certainly open to complain to the LCBO's Freedom of Information and Protection of Privacy Office (listed at the bottom of their Privacy Statement) or the Information and Privacy Commissioner (http://www.ipc.on.ca/images/Resources/cmpfrm-e.pdf). My concern has always been though, won't the ultimate outcome just be for the LCBO to make it harder (impossible?) to do private orders?

All in all another reason to love the LCBO.

[jaymack]

In short... no.

[hops are your friend]

Obviously they should have used bcc to send this email out, but they didn't. Many people make that mistake. I would suggest sending an email back to the sender to remind them of the 'proper' way to do this.

[inertiaboy]

Obviously they should have used bcc to send this email out, but they didn't. Many people make that mistake. I would suggest sending an email back to the sender to remind them of the 'proper' way to do this.

I did that and she thought she had used the BCC until I told her. 90% of errors are because of the system and not the person and this is probably one of them.

[Derek]

Hmmm... perhaps I shouldn't have used my work email address, but my only real concern is the potential for spam.

If I was the importer (Cass), I'd be seriously pissed off that Cecktor's list of clients was just revealed. There's at least one other importer (that could potentially be a competitor) on that list. Maybe not an issue here, but it could potentially be a BIG issue.

[kwjd]

I'm annoyed because my e-mail address was given out without my permission. Practically though, I don't care that my e-mail address is known to people on this order.

It is probably just the mistake of one employee that wasn't thinking rather than a company wide failure.

[SteelbackGuy]

I'm annoyed because my e-mail address was given out without my permission. Practically though, I don't care that my e-mail address is known to people on this order.

It is probably just the mistake of one employee that wasn't thinking rather than a company wide failure.

I would hazard a guess that you are probably right. And as we all know, no member of this forum has ever made a mistake at work.........ever.

Best to still look into it though.