Access request sent to wrong location

PIPEDA Case Summary #2003-239

[Principle 4.9; sections 8(3) and 8(5)]

Complaint

An individual alleged that a telecommunications company did not provide him with access to his personal information within the time limits provided under the Personal Information Protection and Electronic Documents Act (the Act).

Summary of Investigation

The individual sent his written request to the company by courier. When he did not receive a response, he filed a complaint with the Office.

Following discussions with the Office, the company wrote to the complainant some three months after he had initially made the request. In addition to addressing the request, it apologized for the delay in responding. The company explained that the request was mailed to one of the company's operational buildings, a location that does not normally receive correspondence from the public and thus has no established process or personnel to deal with such mail. Consequently, the company had no record of receiving the request.

The courier stated that although it provides the sender with a tracking number to confirm delivery, it does not require a signature by the receiver. Thus, it had no record of who received the request. The Office confirmed with the courier, however, that the request was delivered to the company's operational building.

Findings

Issued December 4, 2003

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) stipulates that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

The Assistant Commissioner noted that, although the request was not addressed to a location where it would be properly processed, and the company had no record of receiving it, the fact remained that the company's ultimate response to the complainant was well beyond the 30-day time limit prescribed under the Act. She therefore found that the company did not meet its obligations under section 8(3), was thus deemed under section 8(5) to have refused the request, and was therefore in contravention of Principle 4.9.

The Assistant Commissioner concluded that the complaint was well-founded and resolved.