An airport is accused of not having disclosed all the personal information requested by an employee and of not having retained other personal information

PIPEDA Case Summary #2003-216

[Principles 4.5, 4.5.2, 4.9 of Schedule 1]

Complaint

An airport employee filed two complaints, stating that her employer did not provide her with all of the personal information in an audio recording that she had requested access to. Moreover, she alleged that her employer did not retain another audio recording for which she made a request and for which she was not therefore able to obtain.

Summary of Investigation

The individual received a letter that set out the administrative measures taken against her for runway incursion and for causing a distraction on the taxiway. The person submitted an application to her employer requesting access to a copy of the recordings-audiocassette-concerning the runway incursion and a copy of the recordings concerning the distraction on the taxiway. The individual received a copy of the audio recordings concerning the two incidents. After listening to them, she submitted another application to her employer to obtain a copy of the audio recordings of the entire runway inspection. The employer responded to this by informing her that it no longer had the requested information. In accordance with the internal directives, the employer believed that this cassette should have been retained for one year, but said that it had probably gotten lost or destroyed, due to human error.

Commissioner's Findings

Issued August 1, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking or business. The Commissioner had jurisdiction in this case because airports are federal work, undertaking or business as defined in the Act.

Application: Principle 4.9 sets out that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. Principle 4.5. stipulates that personal information shall be retained only as long as necessary for the fulfillment of those purposes. Principle 4.5.2 sets out that organizations should develop guidelines and implement procedures with respect to the retention of personal information. These guidelines should include minimum and maximum retention periods. Personal information that has been used to make a decision about an individual shall be retained long enough to allow the individual access to the information after the decision has been made.

With regard to the recording of the runway incursion, the Commissioner indicated that the employer complied with Principle 4.9 of Schedule 1 of the Act by disclosing all the requested information to its employee.

With regard to the recording of the runway inspection, the employer was not able to find the entire recording, as requested by the employee. The employer said that the loss or destruction of the audiocassette was due to human error. In accordance with the written directive concerning the retention of information recordings, the audiocassette of the runway inspection had to have existed at the time access was requested because the one-year retention period had not expired. The Commissioner thus found that the employer did not respect its own directive and infringed on Principles 4.5, 4.5.2 and 4.9 of the Act.

The Commissioner found that the complaint concerning the recording of the runway incursion was not substantiated and that the complaint concerning the runway inspection was well-founded.

Further Considerations

The Commissioner stated that the employer did not respect the requirements of subsection 8(7) of the Act, which stipulates that an organization shall inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under the Act. The response that the employer gave did not inform the individual about this recourse.