Via David Fraser, the Alberta Privacy Commissioner has faulted the parties to an M&A transaction, and their respective counsel, for improper disclosure of personal information. Essentially, in this deal the customary employee schedule contained employee SINs and home addresses, and the schedule was not redacted before it was published on SEDAR, the Canadian online system for securities filings (our EDGAR).
The decision is here.
