Source: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda-compliance-help/pipeda-interpretation-bulletins/interpretations_02/
Timestamp: 2019-04-23 14:07:31+00:00

Document:
One of the Commissioner’s primary roles is to investigate and try to resolve privacy complaints against organizations. While findings on a given issue may differ depending on the facts of each case and the position of the parties. Over time, findings on certain key issues have begun to crystallize into general principles that can serve as helpful guidance for organizations.
In an effort to summarize the general principles that have emerged from court decisions and the Commissioner’s findings to date, the OPC issues Interpretations of certain key concepts in PIPEDA. These Interpretations are not binding legal interpretations, but rather, are intended as a guide for compliance with PIPEDA. As the Commissioner issues more findings, and the courts render more decisions, these Interpretations may evolve and be further refined over time.
Drawing from jurisprudence in the federal public sector, the definition of personal information must be given a broad and expansive interpretation (Dagg v. Canada (Minister of Finance),  2 S.C.R., dissenting, 403 at para 68; Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157; Canada (Information Commissioner) v. Canada (Commissioner of the Royal Canadian Mounted Police),  1 S.C.R. 66, 2003 SCC 8, at para 23).
Personal information is information “about” an identifiable individual. “About” means that the information is not just the subject of something but also relates to or concerns the subject (Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157).
Information will be about an “identifiable individual” where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information (Gordon v. Canada (Health), 2008 FC 258 (CanLII).Footnote 1 Information need not be recorded for it to constitute personal information. It is sufficient that the information be about an identifiable individual even if the information is not in a recorded form, such as oral conversations, biological samples and real time video surveillance. While the absence of a recording may go to the issue of collection, it does not change the fact that the information is personal information (Morgan v. Alta Flights Inc. (2006) FCA 121, affirming (2005) FC 421).
The same information can be personal to more than one individual, where, for example, it contains the views of one individual about another individual, or where the same information reveals something about two identifiable individuals (Wyndowe v. Rousseau, 2008 FCA 39 (CanLII)).
Information will still be personal information even if it is publicly available within the meaning of the regulations,Footnote 2 and is exempt from applicable consent requirements (Englander v. TELUS Communications Inc., 2004 FCA 387 (CanLII)).
Subjective information about an individual may still be personal information even if it is not necessarily accurate (Lawson v. Accusearch Inc. 2007 FC 125).
Information about a company is generally not personal information. However, an individual’s personal information may be so inextricably linked to information about his or her company (e.g. an owner/operator of a small business) that information about that company can constitute personal information about the individual.Footnote 5 Each situation must be assessed on a case-by-case basis.
Sales statistics of telemarketersFootnote 6 and the number of houses sold by real estate brokersFootnote 7 can constitute personal information.
An individual’s views or opinions about an employee (e.g. performance appraisals,Footnote 16 internal investigation files,Footnote 17 medical diagnoses or assessments,Footnote 18 or complaints against an employee)Footnote 19 may constitute the personal information of that employee.
Residential property appraisal documents constitute the personal information of the property owner,Footnote 40 including the selling/purchase price of an individual’s home.
A photograph of an individual’s home may constitute the personal information of that individual.Footnote 45 Video surveillance that captures an individual’s physical image or movementFootnote 46 may also constitute his or her personal information even if it is not taped,Footnote 47 since the definition of personal information in PIPEDA does not require that the information be recorded.
This case arose under the Access to Information Act, R.S., 1985, c. A-1 that incorporates the definition of “personal information” from the Privacy Act, R.S.C. 1985, c. P-21, which is virtually identical to the definition of “personal information” in PIPEDA.
Personal Information Protection and Electronic Documents Act, Regulations Specifying Publicly Available Information (SOR/2001-7).
PIPEDA Case Summary #372 - Disclosures to data brokers expose weaknesses in telecoms’ safeguards.
PIPEDA Case Summary #181 (July 10, 2003), Alleged inappropriate disclosure of personal information to a third party.
PIPEDA Case Summary #220 - Telemarketer objects to employer sharing her sales results with other employees.
PIPEDA Case Summary #303 - Real estate broker publishes names of top five sales representatives in a city.
PIPEDA Case Summary #22 - Company asks for customer’s SIN as a matter of policy; PIPEDA Case Summary #337 - Income tax preparation company mails personal information to wrong clients; PIPEDA Case Summary #317 - Fax from debt collector contained debtor’s personal information.
PIPEDA Case Summary # 277 - Mass mailout results in disclosure of contest entrants e-mail addresses.
PIPEDA Case Summary #374 - Bank faxes credit card account statement to fraudster; PIPEDA Case Summary #176 - Bank records customer call without consent; refuses to erase tape; PIPEDA Case Summary #72 - Telecommunications company improves its collection and disclosure practices.
PIPEDA Case Summary #292 - Former employer changed account information of Air Canada frequent flyer member and PIPEDA Case Summary #241 - Bank complies with consent principles.
PIPEDA Case Summary #370 - Airline broadens interpretation of personal information and improves handling of personal information access requests.
PIPEDA Case Summary #198 - Employer accused of wrongful disclosure.
PIPEDA Case Summary #73 - Telecommunications company asked to adopt consistent retention practices.
PIPEDA Case Summary #233 - An individual challenged the requirement to provide the medical diagnosis on her doctor’s certificate for sick leave; PIPEDA Case Summary #257 - Employees objected to corporation’s requirement; PIPEDA Case Summary #235 - Individual challenges employer’s refusal to grant sick leave; PIPEDA Case Summary #287 - Request for medical information deemed reasonable, but consent procedures not properly followed; Case Summary #284 - Use and disclosure of health information considered appropriate, but access request was mishandled; PIPEDA Case Summary #226 - Company's collection of medical information unnecessary; safeguards are inappropriate.
L’Ecuyer v. Aéroports de Montréal 2003 FCT 573, affirmed by  F.C.A. 237.
PIPEDA Case Summary #149 - Individual denied access to personal information.and PIPEDA Case Summary #360 - Bank erroneously e-mails employees’ personal information to client.
PIPEDA Case Summary #149 - Individual denied access to personal information.
PIPEDA Case Summary #264 - Video cameras and swipe cards in the workplace; PIPEDA Case Summary #290 - Video surveillance cameras at food processing plant questioned; PIPEDA Case Summary #279 - Surveillance of employees at work; PIPEDA Case Summary #114 - Employee objects to company’s use of digital video surveillance cameras; Eastmond v. Canadian Pacific Railway, 2004 FC 852 (CanLII), (2004), 16 Admin. L.R.(4th) 275.
PIPEDA Case Summary #360 - Bank erroneously e-mails employees’ personal information to client.
PIPEDA Case Summary #201 - Former employee encounters delays in accessing personal information.
Wyndowe v. Rousseau, 2008 FCA 39 (CanLII).
PIPEDA Case Summary #2009-018 – Psychologist’s anonymized peer review notes are the personal information of the patient.
PIPEDA Case Summary #348 - Disclosure of diagnosis was inappropriate, but insurance company considered to be open about its privacy policies and practices.
PIPEDA Case Summary #368 - Insurance adjusters’ consent form considered overly broad.
PIPEDA Case Summary #362 -Insurance adjuster readjusts its collection practices.
PIPEDA Case Summary 325 - Personal information practices considered in sale of dental practice; PIPEDA Case Summary 328 - Medical records storage company revises its access policy.
PIPEDA Incident Summary #2 - CIBC's privacy practices failed in cases of misdirected faxes; PIPEDA Case Summary #335 - Customer receives banking information of other clients; PIPEDA Case Summary #332 - Bank issues new guidelines and educates employees after customer information is faxed to the wrong individual.
PIPEDA Case summary #356 - Customer’s banking personal information found in a recycling bin.
PIPEDA Case Summary #317 - Fax from debt collector contained debtor’s personal information; PIPEDA Case Summary #200 - Bank disclosure results in cancelled wedding.
PIPEDA Case Summary #154 - Couple dismayed at receiving unsealed envelope from bank; PIPEDA Case Summary # 336 - Disclosure of mortgage information required by law; collection of information by bankruptcy trustee also allowed.
PIPEDA Case Summary #340 - Law firms collected credit reports without consent.
PIPEDA Case Summary #63 - Bank refuses customer access to internal credit score; PIPEDA Case Summary #39 - Privacy Commissioner releases finding on a bank's refusal to release credit score.
PIPEDA Case Summary #344 - Couple’s safety deposit box opened in error.
PIPEDA Case Summary #390 - Residential Property Appraisal Documents are Owners’ Personal Information.
PIPEDA Case Summary #130 - Disclosure of personal information in the collection of a debt; PIPEDA Case Summary #267 - Bank discloses customer's personal information to employer.
Wansink v. TELUS Communications Inc. (F.C.A.), 2007 FCA 21.
PIPEDA Case Summary #349 - Photographing of tenants’ apartments without consent for insurance purposes.
PIPEDA Case Summary #1 - Video surveillance activities in a public place.
PIPEDA Case Summary #351 - Use of personal information collected by Global Positioning System considered.
Radio Frequency Identification (RFID) in the Workplace: Recommendations for Good Practices: A Consultation Paper, March 2008.
What an IP Address Can Reveal About You, a report prepared by the Technology Analysis Branch of the Office of the Privacy Commissioner of Canada, May 2013.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.