Airline accused of improper disclosure of travel information to government department

PIPEDA Case Summary #2002-62

[Principles 4.3 and 4.5, Schedule 1; and section 7(3)(c.1) (iii)]

Complaint

An individual complained that an airline had disclosed his personal information, specifically details of his travel itinerary, to his federal government employer, without his consent and for a purpose other than that for which the information had been collected.

Summary of Investigation

In the course of investigating the complainant's use of sick leave, the federal government department in question requested that the airline confirm certain travel itinerary information about the complainant. The airline, citing its obligations under the Personal Information Protection and Electronic Documents Act, asked the department for assurance either of the complainant's knowledge and consent in the matter or of the application of a specific exception or exemption under the Act.

The department responded by letter that it was conducting a lawful investigation pursuant to a cited directive under the authority of a specific act. The department indicated that the information request was for purposes of administering federal public servants' employment legislation, regulations, and policies. The department asked that the airline consider disclosing the requested information without the complainant's consent by application of section 7(3)(c.1) (iii) of the Act. On consideration of this letter, the airline disclosed the requested information to the department.

The complainant had also filed a complaint against the department under the Privacy Act. In investigating that complaint, the Commissioner's Office discovered that the directive the department had initially cited as its lawful authority was incorrect. The department subsequently submitted representations acknowledging this mistake, but demonstrating that it did nevertheless have lawful authority for the collection under other legislation.

The airline's position was that the department's request letter citing its authority had met all the criteria of section 7(3)(c.1)(iii) of the Act and had therefore been sufficient in itself to demonstrate the applicability of that section.

Commissioner's Findings

Issued July 22, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction because airlines are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, and disclosure of personal information, except where inappropriate. Principle 4.5 states that personal information must not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Section 7(3)(c.1)(iii) is an exception to Principle 4.3, permitting disclosure of personal information without the individual's knowledge and consent if a government institution has requested the information for the purpose of administering any law of Canada or a province and has identified its lawful authority to obtain the information.

Though the Commissioner was satisfied that the department did have lawful authority to collect the complainant's personal information, it remained a matter of concern to him both that the department had initially cited an incorrect authority and that the airline had failed to verify the correctness of the cited authority.

The Commissioner did not doubt that the airline had made the disclosure in good faith, believing on the basis of the department's letter that the criteria for applying the exception provision had been met. However, where requests for disclosure of personal information were concerned, the Commissioner considered it incumbent upon any private-sector organization not to take the submissions of any government organization at face value, but rather to be vigilant about checking authorities cited. Mindful that the airline had not been duly vigilant, he determined that section 7(3)(c.1)(iii) had not been properly applied as an exception to the requirement for the complainant's knowledge and consent. He found therefore that the airline had not complied with Principles 4.3 and 4.5 of Schedule 1.

The Commissioner concluded that the complaint was well-founded.