Many businesses are not complying with Alberta’s law surrounding the collection, use and storage of customers’ personal information, says the province's privacy office.

The Personal Information Protection Act, (PIPA), has been law for nine years, but a survey conducted by Alberta’s information and privacy commissioner found many companies haven’t trained staff on protecting customers’ information.

"About 50 per cent of organizations are saying that ‘Yes, we have a training program’, which means 50 per cent don’t," said Brian Hamilton, director for the Office of the Information and Privacy Commissioner.

Edmonton woman ‘shocked’ by texts from mechanic

Samantha Ropchan was shocked when she recently received a series of late-night text messages from someone she didn’t know.

"At first I was just wondering who it was," Ropchan said.  "Then it got to a point where it started to get a bit weird and creepy."

si-go-public-privacy-ropchan

Samantha Ropchan was shocked when she recently received a series of late-night personal text messages from someone she didn’t know. (CBC)

The texter gave his first and last name. Ropchan said she didn’t know him. 

After asking her about her ethnicity, he said he was a mechanic at Sherwood Ford and that he got her number when she had her car serviced.

The texter then sent her a picture of himself. He asked about some of her friends at which point Ropchan ended the text exchange.

She said she hasn’t done business with Sherwood Ford for more than a year and had never met any mechanics, only the service advisors up front.

She’s upset that someone kept her number that long, used it for personal reasons and had even researched the names of her friends.

"It wasn’t as though a person accidentally saved a number in his phone. He could have deleted it. And secondly he took it one step further to find out something else about me."

Company brushed off complaints,  woman says

When she first contacted Sherwood Ford, management appeared to be genuinely concerned and said they would investigate, Ropchan said.

However, when she called to follow up, the company said the employee denied accessing her information through company files and suggested she may have given him her number himself.

"They basically said there was nothing to be done about it. There was no privacy breach," Ropchan said. "I was told that the conversation was over."

si-go-public-privacy-texts_1

A texter claiming to be her mechanic, said he obtained Samantha Ropchan's text address when she brought her car in for servicing. (CBC)

"I felt like they weren't taking me seriously and they just wanted to sweep the issue under the rug, so I was quite upset about it."

Ropchan contacted the RCMP who said there was no criminal act involved. She also contacted Ford of Canada who told her that privacy complaints were the responsibility of the individual dealership.

She also complained to the Better Business Bureau.

In its written response to the BBB, Sherwood Ford said, "This situation has now been looked at by the RCMP and we have done what we need to do as far as the situation and the RCMP are satisfied and so are we with the situation.

"We will not issue an apology to her for anything to do with Privacy act as there wasnt (sic) an issue with her privacy being breached."

The BBB closed the file saying privacy issues are outside its domain.

Case raises several privacy ‘red flags’

Brian Hamilton of the privacy commissioner’s office says the case raises several concerns, including how many people in a business have access to customers’ personal information.

"Not everyone in a business needs to know everything about all the customers, and we’d definitely want to know how a piece of information fell into a particular employee’s hands," Hamilton said.

si-go-public-privacy-sherwood-ford

Sherwood Ford declined repeated requests for an interview. (CBC)

A greater privacy breach is using a customer’s contact information for purposes other than the business reason for which it was gathered.

"How would you feel if someone you didn't know, who you'd entrusted your personal information to, started contacting you out of the blue?" Hamilton said.

"The organization has collected some information about you. They're in a position of power. They’ve got your information for a particular purpose.

"If they or a rogue employee starts to use it for some other purpose, then I think many people would feel perhaps violated, or at least feel that it’s just not fair."

Company stands by its position

Go Public spoke by phone with Kelly O’Connell, vice-president and general manager of Sherwood Ford.

He said the company won’t discuss matters to do with customers or employees and declined repeated requests for an interview.

Ropchan said her complaint would never have gone so far if the company had taken her concerns more seriously.

"I was only one person against this rather large dealership and they were basically just trying to blow me off. All I want them to do now is apologize and be accountable for what happened."

Hamilton said companies can head off a lot of complaints early.

"If you give somebody the brush-off, they’ll probably end up at our office."

Hamilton said the vast majority of complaints to the privacy commissioner are solved with mediation.

However the law does allow for fines — $10,000 per offence for an individual and $100,000 per offence for organizations.