Bank alleged to have denied customer access to her personal information

PIPEDA Case Summary #2003-247

[Principle 4.9; sections 8(3), 8(5) and 8(6)(a) and (b)]

Complaint

An individual complained to the Commissioner's Office when she did not receive a response from her bank to her request for personal information.

Summary of Investigation

The complainant had requested a number of documents relating to an account, closed for many years, that she had had with the bank. In her request, she informed the bank that she expected it to have the information ready to be picked up on a particular date. She also expressly told the bank not to send her any information by mail.

The bank acknowledged receiving her request. After reviewing it, the bank estimated that providing the information would cost between $500 and $800. Given this, the bank wanted to discuss the matter with the complainant before proceeding with her request. It made several unsuccessful attempts to contact her by telephone. Since she had stated that she did not want any information sent to her by mail, the bank interpreted this to mean that it was not to even send her a letter regarding the fee by mail. The bank presumed that she would come in on the date indicated in her request, and that it would then discuss the matter with her at that time. As she did not visit the branch on that date or thereafter, it was waiting for her to contact it and confirm that she would pay the costs. The bank did not hear from her again until it received notification of her complaint with the Office.

At the Office's request, the bank wrote to the complainant (who in fact had not objected to receiving correspondence by mail) and provided her with a fee estimate. The Office had advised the bank that the Personal Information Protection and Electronic Documents Act (the Act) stipulates that personal information is to be provided at "minimal or no cost." Consequently, the bank requested a fee of $75, which the complainant paid. She is now receiving her requested personal information.

Findings

Issued December 8, 2003

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Assistant Privacy Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) stipulates that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request. Sections 8(6)(a) and (b) state that an organization may respond to an individual's request at a cost to the individual only if the organization has informed the individual of the approximate cost and the individual has advised the organization that the request is not being withdrawn.

The Assistant Commissioner acknowledged that, strictly speaking, the bank had exceeded the 30-day time limit; however, given that the bank intended to charge a fee for the request, it was obliged, pursuant to sections 8(6)(a) and (b), to inform the complainant of the fee estimate and to give her an opportunity to respond. It had attempted to contact the complainant a number of times by telephone, since she had asked not to have any information sent to her by mail. It then decided to wait until she arrived at the bank on the date she had said she would. When she did not show up, the bank chose to wait until it heard further from her before proceeding. The Assistant Commissioner was satisfied that, in the circumstances, the bank had acted in good faith and made a reasonable effort to accede to her request and thus fulfilled its obligations under the Act.

The Assistant Commissioner concluded that the complaint was not well-founded.

Further Considerations

The Assistant Commissioner took the opportunity to remind the bank that, with respect to its fees for access to personal information requests, the Act requires organizations to provide personal information at minimal or no cost to the individual.