Frank Work, Information and Privacy Commissioner, received a privacy complaint concerning the above named organizations. The Complainant was concerned that the Melrose Rural Electrification Association (Melrose REA) and its service provider, ATCO Electric, had disclosed customer information to Direct Energy Marketing Limited in contravention of the Personal Information Protection Act (“PIPA” or the Act).
In 2004, as part of a sale of retail electricity assets, ATCO Electric transferred customer information of members of the Melrose REA to Direct Energy Marketing Limited (DEML). DEML took over the regulated rate tariff and billing service previously provided by ATCO Electric.
The investigation found that:
- the disclosure of personal information between the parties was done in accordance with the PIPA, which allows the disclosure without consent if the future use and disclosure of personal (customer) information is limited to the provision of services originally undertaken by ATCO Electric; and
- the personal information disclosed to DEML was limited to what was required to carry on the business – i.e. serving the purposes of providing electricity and billing for the services to the regulated rate customers of the Melrose REA.
This report outlines organizations’ privacy obligations when personal information is disclosed through mergers, acquisitions and other similar business transactions.
All parties are commended for the degree of assistance and cooperation given to this Office.