The Privacy Commissioner found a trial collected individuals’ sensitive information without consent, failed to take reasonable steps to notify individuals that their personal information was being collected.
