Episode 51: Office of the Privacy Commissioner of Canada
Summary
As a tenant, how do you know all the info your landlord collects is kept private? What do they do with all that information? What if there is a privacy breach and my info is compromised? In today's episode I review the detailed email the Office of the Privacy Commissioner of Canada provided with you. There is an amazing amount of information for both tenants and landlords, including the Privacy Commissioner's ruling on security cameras in common areas AND "bad tenant lists". Join me today for an amazing introduction into the privacy involved in rentals!
Listen to full episode :
*BONUS RESOURCES* All of this Episodes Hyperlinks!
Provincial Laws that May Apply Instead of PIPEDA
Privacy in the Landlord and Tenant Relationship
Meaningful Consent and the Guidelines for Obtaining Meaningful Consent
PIPEDA Fair Information Principles
PIPEDA Fair Information Principle 7 – Safeguards
Property Management Company Agrees to Scrap "bad tenant list"
When Using Video Surveillance, Security Needs Must Respect Privacy Requirements
What you need to know about Mandatory Reporting of Breaches of Security Safeguards
Full Episode Transcription
Welcome to my life as a landlord where we untangle all things housing and educate the curious. If you're
looking for some entertainment with some honest, awkward conversations, you've come to the right
show. I'm your host, Dr. Jennifer Salisbury. This is my life as a landlord. Welcome to it.
Hello there. Welcome to my life as a landlord. I am Doctor Jen and I am so happy to have you today on
episode 51. This is a tenant perspective topic and I am super happy to share with you the detailed
response that I received from the office of the Privacy Commissioner of Canada. I emailed them and said,
hey, want to be a guest on my podcast? And while they declined the interview, they provided an amazing
email with a ton of information. And I'm going to go through that email, and then we're going to put the
email with the live hyperlinks up on the website. My life is a landlord comm, but I'm excited because this
whole idea of privacy is becoming more and more critical. And as a tenant and also as a landlord, you
need to know whether you're in Canada or the US or beyond. The privacy is becoming more and more of
a hot topic. And so here we go. Um, even though I don't have a guest on today's podcast, uh, the, the
expertise that comes through this email, I can't wait for you to understand it. And, uh, I have reached out
to so many different guests and I've gone big. I'm not going to read the the the guest, the potential guest
list, but just know it's their big and it's all about providing value to you. So the office of the Privacy
Commissioner of Canada responded, and I'm going to go through this email. I'm not going to read it word
for word. I'm going to go through it because they do provide some, uh, similar items. But this is pretty
neat. So the person who reached back out to me is named Vito 2s Pyle ISI. And this is of course their
their tag on the bottom is in English and in French, because this is the office of the Privacy
Commissioner of Canada. They've got to have the English version of the email is of course, what he sent
me. I'm assuming it's a he. Um, but pretty interesting information. So I'm just going to keep going. I'm
just going to read through this and then I'll explain as we go. So hopefully this isn't too boring. But again,
take a look at this. Um, thank you for reaching out to our office. Please find below the information about
the federal private sector privacy law and how it applies to the context of landlord and tenant
relationships. Unfortunately, we're not able to provide an interview at this time. Okay. 1s So just a few
opening sentences. Federal private sector privacy law. So federal means it is countrywide. And by the
way, US is similar, US is similar. And I'm finding that when you're comparing between the US and
Canada, it's it seems that Canada is actually more strict than the US. So I'm just going to put that out
there. It seems that way. But this for for the context, for my US listeners, this seems to be pretty
interesting as far as privacy, the leading edge of the privacy requirements. So this is federal. This is not
state, territory or provincial. We'll talk more about that as we go. And then private sector. These are not
public companies. This is not an organization. He's talking about private sector folks like you and me.
We're we're talking about, um, for profit typically um, companies or mom and pops that exactly who we
are. Or we've got tenants, tenants or individual people. And this is all part of the private sector. Okay,
here we go. Landlords in Canada may be subject to a few different laws regarding privacy. The office of
the Privacy Commissioner of Canada is responsible for overseeing compliance with two things. Personal
Information Protection and Electronic Documents Act, or Pepita, Personal Information Protection and
Electronic Documents Act and the Privacy Act. So you've got Pepita and you've got the Privacy Act.
Okay, Pepita. Again, I'll say it again. Personal Information Protection and Electronic Documents Act is
Canada's federal private sector privacy law, which applies to the collection, use and disclosure of
personal information in the course of commercial activities such as rentals. The Privacy Act, the second
part of what the office of the Privacy Commissioner of Canada takes care of the Privacy Act, is Canada's
federal public sector privacy law that only applies to federal government institutions. So here we're only
talking about Pepita okay. Personal information protection, electronic document act okay. Further, three
provinces, British Columbia, Alberta and Quebec, have private sector privacy laws that have been
deemed substantially similar to Pepita on the provincial side, which may apply to commercial
organizations such as landlord instead of or in addition to Pepita in those provinces. So he's mentioning
specifically that depending on where you are in Canada, it may not just be the federal stuff, it may also be
provincial stuff that requires for privacy laws. Okay. So then we talk a little bit more. He talks about
what the Privacy commissioner is, how it all works. And then he goes into to a couple of different, um,
how it how the the commissioner is ruling on privacy stuff. This is really interesting because you guys
are going to you're going to see this, especially if you're any of the forums on social media. Uh, okay. So
let's talk about the privacy privacy commissioner of Canada. It's actually this person is actually an agent
of Parliament of Canada, Parliament, whose mission is to protect and promote privacy rights. The office
of the Privacy Commissioner of Canada is headquartered in Gatineau, Quebec, which I didn't know.
That's kind of cool. So back east and they've got several hyperlinks. So they said this page contains the
contact information, including the information center, which responds to questions from individuals,
organizations about privacy rights and obligations. So if you are a tenant listening to this, you can go into
one of these hyperlinks directly to the office of the Privacy Commissioner of Canada and write to them
directly, just like I did. I did the same thing. And you can go in and say, this is what's happened, this is
what's going on. What are my rights as a tenant? Similarly, you can do it as a landlord. Okay. Now
they've got so many people asking questions that he continues. We have developed the following
guidance, which discusses privacy issues affecting tenants and landlords, such as ten and concerns about
over collection and inappropriate use of personal information, the use of surveillance cameras, and the
disclosure of tenant information to third parties. Interesting. So there's a hyperlink there that says privacy
in the landlord tenant relationship. Now you can already see what my call to action is going to be, is I
want you to go in and take a look at all these hyperlinks, but I'm going to keep going because there is so
much information in this email. It's as if I'm interviewing him because this was such an amazingly well
written email. I'm just I was so excited to show this with you. Okay, let's keep going. Our office regularly
receives questions from both landlords and tenants pertaining to various issues, including what personal
information is acceptable to collect, how that information can be used once it is collected, and how
should the information be retained after it is collected. Both landlords and tenants should know where
Pepita applies. Again, Pepita is Personal Information Privacy and Electronic Document Act where it
applies and it sets out a number of obligations for organizations. Again, there's hyperlinks all through this
so that if you've got a question, you just go in. Generally speaking, Pepita requires organizations to
obtain meaningful consent, meaningful consent specifically from the tenant for the collection, use, or
disclosure of personal information, such as, for example, the purposes of tenant screening or tenancy
management in this regard. Our office has issued guidelines for obtaining meaningful consent. So I'm
going to stop right here for my Canadian landlords out there. And also for the US landlords. I mean, this
is not a bad thing. The privacy guidelines is here. You've got to receive meaningful content sent from
your tenants, your potential tenants, to collect information from them. So the guidelines here is pretty
spectacular. It it's very specific on what you need to do checkboxes on your applications. The verbiage
that you need to use, you need to go in there and learn a little bit more about this. Furthermore, he
continues, the collection of personal information must be limited to that which is needed. Personal
information must be as accurate, complete, and up to date as possible, and individuals have a right to see
the personal information that businesses have about them on file, and to correct any inaccuracies upon
request. Landlords should be prepared to respond to access queries from tenants. Organizations are also
required to safeguard the personal information in their care, and the safeguard aspect in that sentence is
hyperlinked. How do you safeguard stuff? You safeguard it with locked cabinets, passwords, passwords
on computers, things like that, and they talk exactly about how to do it. Now, let me just step aside here
for a second. When we're talking about this, landlord should be prepared to respond to access queries
from tenants about what personal information the business has on file. In the event a tenant has provided
a credit report and score, or they've provided consent for me to pull their credit or paid for their credit
regardless. Remember, on the Canadian side, a landlord pays for the credit report. On the US side, the
tenant pays for the credit report or provides it either way. But if there is something in that credit report
that I have found as a landlord, I always go back to the tenant and I say, are you aware of this is in here
about half the time the tenant is aware, and the other half of the time they had no idea there was
something in here. And so it works both ways. You may not just have a tenant asking for what
information the landlord has on file. It may also be the landlord finding stuff, saying, hey look, did you
know that this was in your credit or this was going on okay. Here we go. Now we go into two different
scenarios about complaints that have been filed in their office. And this is really interesting because I
have seen both scenarios in the discussion forums and social media. So this is very interesting how we
go, okay, if an individual believes that an organization is not respecting its obligations under Pepita again
paid up Personal Information Protection and Electronic Documents Act. Okay, that's Pepita, they have
the right to file a complaint with our office. This is typically tenants filing a complaint with our office.
And the file a complaint, of course, is a hyperlink. Our office has investigated some complaints related to
issues pertaining to landlords and tenants. And for example, there are two scenarios here. And I'm so
excited to share these scenarios with you because they are absolutely white, hot and active on social
media right now. Okay, so there's two ones. And of course they both have hyperlinks to the full report.
Okay, a complainant alleged okay, wait a minute. Let me go back and read the the the heading okay.
Property management company created a quote unquote bad tenant list. And as a result of a complaint
filed with the office.They agree to scrap that bed tenant list. Okay, so here's how this went down. A
complainant alleged that a property management company was improperly collecting, using and
disclosing tenants personal information in order to create a list of quote unquote, bad tenants. The
information on the list was being shared with a database operator who made the list available to other
landlords online. Our office recognized that the collection, use, and disclosure of the personal
information by a landlord may be appropriate in certain circumstances, but this would be for the express
purposes of verifying a prospective tenants ability to pay rent on time or to determine suitability in the
context of a rental application process. However, in this case, the office of the privacy. Let's see. I want
to make sure I say it right. Office of the Privacy Commissioner of Canada. They found the office, found
that the database operator failed to take the adequate steps to ensure landlords had obtained meaningful
consent from the tenants, to include their information in such a list. Furthermore, a bad tenant list
included information about the individual's past paying habits, and we found that by providing members
of a landlord association to this type of information, the property management company was in the
context of the applicable provincial legislation, acting as the credit reporting agency, and was doing so
without the required license. In those circumstances, it was our view that the purpose for which it was
collecting, using or disclosing personal tenant's information was not appropriate and thus a violation of
the Personal Information Protection and Electronic Documents Act. Very interesting. We've talked about
this quite a bit on on social media saying, you know, can this, this, these are the bad tenants. Can we
create a bad tenant list? Well, the answer is no, not for the purpose of sharing about the bad tenants
because there's no meaningful consent. Okay. So that's very interesting. So the second one is all about
using surveillance cameras. Uh, when using video surveillance, security needs must respect privacy
requirements. This is interesting. Okay. So the office of the Privacy Commissioner of Canada.
Received a complaint and this is how Vito responds. This investigation involved an individual that
complained to our office about the use of video surveillance in his rental building. He alleged that the
video cameras installed in the building were collecting excessive and unreasonable amounts of personal
information. As a result of this investigation, and in response to our recommendations, the property
manager to the property agreed to remove the hallway cameras in the building stairwells and reposition
all outside cameras so they did not record the public spaces to ensure the video is viewed after security.
And wait a minute, let me slow down and to ensure that the video is reviewed only after security related
issue has been reported. Fantastic. So I have security cameras on my properties and they are all recording
public spaces. And here's the funny thing we don't look at them unless there is a problem. And honestly,
most of the problems that we have are bears encroaching on the property. This is in Canada. It's not
necessary a security issue for anything else. So this is very interesting that the Privacy Commissioner has
ruled on this. Okay. I also discussed how about what what does a tenant do if there has been a breach in
privacy, what is actually the whole protocol on how to do. And so he he asks specifically or he answers
specifically about my question about the breaches. Okay. He says finally, you asked about breaches and
security organizations subject to Pepita are required to report. And of course, that's a hyperlink required
to report to our office and notify the affected individuals of all breaches involving personal information
that create a real risk of significant harm to an individual, real risk of significant harm. Now, that's a
pretty technical word. And again, that's also a hyperlink. I'm not going to go into what that is. But real
risk of significant harm to an individual is the requirement. You've got to report it. This requirement
applies to landlords who are subject to the act. And of course I'm talking about the Personal Information
Protection and Electronic Document Act. Once an organization has determined that a breach of security
safeguards involve a real risk of significant harm to an individual has occurred, it must. There's four
things it must do contact the affected individuals as soon as feasible. That makes sense. Directly notify
these individuals by email, phone or any other appropriate form of communication. In certain cases,
individuals must be indirectly notified if you can't get Ahold of them. For an example, if an organization
does not have a person's contact information, then in this case, indirect notification should be made via a
prominent public announcement, which could could maybe be a poster or something outside of, let's say,
an apartment building. If you had a privacy breach and you no longer have contact information for
someone that maybe doesn't live there anymore, right? Because otherwise you'd have their contact
information in theory. Okay. In the last aspect they said give the individual where the the privacy breach
has occurred. Give the individual an easy to understand information to explain the situation, which is
what happened and when, what is being done to remedy the matter. The steps the affected individual
could take to protect themselves from harm. For example, change your passwords, change your login for
your computer, that kind of thing, and a personal and a person that the individual can contact should they
have any questions. And of course, they have two bigger hyperlinks saying for more information on
privacy breaches there's two links here. It says what you need to know about mandatory reporting of
breaches of security safeguards. And then the second one tips for containing and reducing the risks of a
privacy breach, which is pretty interesting. So. Because today's podcast is tenant based. I also put this and
he he adds, he ends the his email saying this. We have also developed information for individuals, which
is a hyperlink explaining explaining what they should do, uh, if they know they have been affected by a
breach and received a breach notification for an organization. So if a tenant information has been
compromised and promoted and presents a real risk of significant harm, then the office of the Privacy
Commissioner, Canada has gone back and said, okay, here's information of what this tenant could do
based on this breach. And so it's very interesting how this all is. I'm going to put this email on the
website, and I've instructed my team to make sure that we can do it with all the live hyperlinks, because
this is really chock full of information. I mean, you could go down any one of these hyperlinks and learn
more about privacy requirements, and it's becoming a bigger issue. I suspect we're going to do more
podcasts on privacy and probably next time, what I'll do is I'll do it from the US side so you can go, you
can see it from the US side as well. I suspect you're going to see it's a lot of the same thing. So here's
your call to action, my friends, uh, my listeners, all of you out there trying to educate yourself, go to my
life is a landlord.com. Check out this incredible email that I got from the office of the Privacy
Commissioner of Canada. Make sure you're in compliance with the privacy requirements in your area,
and that you're educated on the privacy requirements for tenants. Right. Tenants out there, you need to
understand what your landlord should be doing properly through the entire entire aspect of your housing
journey. Uh, educate yourself, which is great. So go and check this out. I was just thrilled and floored
when I saw this email for response for the Privacy Commissioner of Canada. That was phenomenal.
Thank you so much for joining me today. Let me know your comments and questions by email me at.
Learn at my life as a landlord.com. Don't forget the free resources on the website, including this email
and two free Blackout Bingo cards. I'm excited for you to educate yourself and track it in a fun way while
you're doing so. Join me for next week's podcast topic. It is another Solsbury and Adventure episode
number 52. I interview my US Naval Academy classmate, who happens to be the Deputy Commandant at
the US Naval Academy right now. Guest Navy Captain David Foreman. I will see you there.
Thank you for joining us this week. To view the complete show notes
and all the links mentioned in today's episode, visit our website at www.mylifeasalandlord.com. If you're
looking for educational resources for getting into real estate investing, becoming a landlord, or even a
better tenant, then I have a page on my website to get you started looking for a solution to the pickle that
you're in. I have suggestions for that too. You can throw your situation on My Facebook Group My Life
as a Landlord and let our community help you with solutions. Also, before you go, make sure you
subscribe to the podcast so you can receive new episodes right when they're released. You can to
subscribe right now in the app you're listening to this podcast on or you can sign up at www.mylifeasalandlord.com.
Thank you again for joining me, Dr. Jennifer Salisbury in this episode of My Life as a Landlord. I'll see you next time.