Denied access to personal information in human resource file

PIPEDA Case Summary #2002-101

[Principle 4.9, Schedule 1; section 8(3), 8(5)]

Complaint

An individual complained that her former employer, an interprovincial transportation company, refused her access to her human resource file and to her training records that she had requested.

Summary of Investigation

The individual wrote to the company, requesting access to all of her personal information in her human resource file, as well as records of the training she had received with the company and copies of any training certificates she had obtained. The company did not initially comply with the individual's request.

At the intervention of the Commissioner's Office, the company indicated that at the time of the individual's request, it was unaware of the Act and admitted that it had withheld the complainant's personal information. After providing the company with a copy of the Act and the accompanying business guide, the Commissioner's Office met with the company to discuss its responsibilities with respect to the Act. Shortly thereafter, the company sent the individual copies of the documentation in her file, as well as her training certificates.

The Commissioner noted that, after the meeting with his Office, the company appointed an individual who is accountable for the organization's compliance with the Act. It also implemented a policy related to the handling of privacy issues and established procedures to receive and respond to requests for personal information.

Commissioner's Findings

Issued December 19, 2002

Jurisdiction: As of January 1, 2001 the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner has jurisdiction in this case because an interprovincial transportation company is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An organization shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if an organization fails to respond within the time limit, the organization shall be deemed to have refused the request.

The Commissioner determined, and the company did not dispute, that it failed to give the individual access to her personal information within the 30-day time limit set out in the Act. He found, therefore, that the company had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused her request, and was therefore in contravention of Principle 4.9. Nevertheless, he noted that the complainant was satisfied with the action taken by the company, and that she had received all of her information and considered the matter resolved.

The Commissioner concluded that the complaint was well-founded and resolved.