Noted in passing — a PIPEDA-related FCA decision (2023 FCA 189) validating a Federal Court ruling of a “stalemate” (2023 FC 166, [102]) that gives more standing to bodies that refuse information requests because the requesting party cannot provide adequate identity verification. In this case it’s Amazon, a password reset and its identity verification steps not being followed.
I’m not a huge fan of Amazon, but on its face this seems correct. I don’t have an issue with this decision per se, but it does raise questions about what kinds of structures a company (or organization; you can see my interest in FIPPA and higher ed institutions here) can put in place to verify a user’s identity, and at what point those systems become burdensome to the point of being unreasonable for the end user.
In the FC decision, there’s an interesting point made about Amazon requiring new terms of service to be accepted as part of the verification process — again, I don’t think Amazon was in the wrong here, but the idea that terms of service can be revised, and that a user is forced to accept them to access data established under the former terms of service, doesn’t sit entirely well.