P2017-ND-027

On September 2, 2015, the Organization was notified by the Office of the Information and Privacy Commissioner that a complaint had been received concerning the Organization?s practices. The Organization initiated an investigation, and discovered that on four separate occasions (January 9, 2015, April 29, 2015, June 5, 2015 and June 12, 2015) communications from one of the Organization?s service providers had been emailed to customers in error. In brief, emails addressed to Customer A included an attached letter addressed to Customer B. The letters were generic in that they were ?managed event? mailings; however, they included the personal information at issue.