The tribunal found that BMN’s privacy was breached by Stonewood in three ways: The collection of his information was for an unlawful purpose (IPP 1). It was collected from an indirect source (IPP 2).