On February 22, 2013, the Office of the Privacy Commissioner of Canada (OPC) released a summary of findings in two cases arising out of inappropriate sharing of information between two summer camps about a child following an online application for a summer camp spot.
The issue arose when the child’s legal guardian completed an online application for a position at a camp. The child had spent the previous two summers at a different camp. The OPC report of findings notes that the child is disabled. During the online application process, the legal guardian accepted an “Additional Agreement”, which, according to the OPC, provided that “camp directors, at their discretion, could use the information supplied in applications for any means.”
The prospective camp contacted the first camp and asked questions about the child’s history at the previous camp and the level of support that the child required as a camper. The exchange came to light when the prospective camp allegedly refused the child’s application on the basis that the child could not be supported at the camp and that the “child’s disabilities would not be fair to other campers.”
Although the camps claimed that sharing of information about children was commonplace in order to assure that campers have a successful summer, the camps were members of the Ontario Camps Association, which adheres to a Code of Professional Ethics, requiring camps to adhere to the Personal Information Protection and Electronic Documents Act (PIPEDA).
The previous camp did not obtain any form of consent to the disclosure of a child’s application history or experience at the camp. This was a fairly open and shut violation of the requirement of PIPEDA to obtain consent to the disclosure of personal information.
However, the prospective camp defended against the complaint on the basis that the legal guardian had consented to the collection, use and disclosure of personal information about the child when the legal guardian accepted the “Additional Agreement”.
Not so, found the OPC. The “Additional Agreement” was too general and overly broad to obtain meaningful consent to the collection, use and disclosure of personal information.
The prospective camp made four errors:
The prospective camp used information in the application to conduct a background check on the child by contacting the previous camp.
The prospective camp disclosed information to the previous camp in order to elicit information about the child.
The prospective camp collected information from the previous camp.
The prospective camp used the information from the previous camp in order to evaluate the child’s application.
The OPC findings with respect to the previous camp, can be found here. The OPC findings with respect to the prospective camp can be found here.