PIPEDA-2003-192
Date: 2003
Summary: OPC found a bank’s consent clauses too vague to meet meaningful consent requirements. Clauses failed to specify what information was collected, for what purposes, and to whom it would be disclosed. The Commissioner stressed that “opt-in” is preferred, but “opt-out” can be acceptable if:
- Information is demonstrably non-sensitive.
- Sharing is limited and well-defined.
- Purposes are clear and communicated at collection.
- Individuals have a simple, immediate, and inexpensive opt-out method, communicated at collection.
