Individual is denied access to personal information

PIPEDA Case Summary #2003-165

[Principle 4.9, Schedule 1; Subsections 8(3) and 8(5)]

Complaint

An individual complained that a telecommunications company denied him access to personal information regarding his account.

Summary of Investigation

The complainant requested certain documents regarding his account. Ninety-three days later and at the intervention of the Commissioner's Office, the company sent the complainant the requested documents. The company indicated that it was unable to answer the request within the specified time limit because the complainant's letter was not sent to the appropriate department. The company assured the complainant that it would review its procedures to prevent this type of situation from happening again.

Commissioner's Findings

Issued April 17, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because the company in question is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.9 states that upon request, an organization shall inform an individual whether or not the organization holds personal information about the individual. The organization shall allow the individual access to this information. Subsection 8(3) establishes that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Subsection 8(5) states that, if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

Since the company sent the complainant the information he had requested ninety-three days after receiving his request, which is sixty days beyond the period prescribed by the Act, the Commissioner found that it did not meet its obligation under subsections 8(3) and 8(5) and thus was deemed to have refused the request contrary to Principle 4.9. However, the Commissioner was pleased to note that the company ultimately provided the complainant with the requested information and that the complainant was satisfied.

The Commissioner concluded that the complaint was well-founded and resolved.

Further considerations

The Commissioner was pleased to note that following the complaint, the company proceeded to review its procedures for processing access requests to avoid such delays in future.