Company refuses former employee's request for access

PIPEDA Case Summary #2004-285

(Principles 4.9 and 4.9.4; subsections 8(3) and 8(5))

Complaint

The complainant, a former employee of a company, complained that the organization had failed to respond to his request for access to his personal information within 30 days and that it was trying to charge him an unreasonable amount of money to process his request. When the company eventually released some documents, the complainant alleged that he was not provided with all of the personal information he was seeking.

Summary of Investigation

The complainant had been dismissed by the company some months prior to his request, and was suing his former employer. The complainant was seeking information about himself that the company might have from around the date of his dismissal to the time he made his request, which he had indicated in his letter of request to the company. He was also seeking minutes from meetings of the board of directors.

The company did acknowledge receipt of the request within the 30-day time period. However, the letter characterized the complainant's request as "sweeping" and virtually requiring a "forensic audit." The company also included a cost estimate in the order of $1,500 to respond to his request, payment for which it wanted in advance.

The complainant wrote back to his former employer, disputing the fee, and reiterated the time period he was interested in. When the company did not respond, he complained to the Office.

The company vigorously objected to providing the complainant with access. Given that the complainant had filed a lawsuit against the company, it took the position that his access request was directly linked to his claims for wrongful dismissal and breach of contract, and that his complaint with the Office was intended to circumvent the disclosure and production rules under the Rules of Civil Procedure. In spite of its initial refusal, the company did provide the complainant with a package of his personal information several months after the complaint was filed. The complainant, however, believed that there was more personal information that had not been released.

Our Office reviewed the minutes of the company's board of directors meetings for the period in question, and determined that the complainant's personal information contained in these documents was not provided to him. We also found his personal information in other documents that had not been released. We met with two board members, who indicated that to the best of their knowledge, no board member had made notes during meetings where the complainant's dismissal or lawsuit was discussed.

Notwithstanding the fact that the company released some information to the complainant, it continued to believe that he was trying to circumvent the legal process and that his complaint was frivolous and vexatious. The company was also of the view that minutes from board meetings should not be made available as this is confidential information, and that members should have the right to discuss a confidential lawsuit without fear of the discussions being released under a request made under the Act.

Findings

Issued December 21, 2004

Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Under Principle 4.9.4, an organization shall respond to an individual's request within a reasonable time and at minimal or no cost to the individual.

Subsection 8(3) stipulates that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Subsection 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• As nearly six months passed before the complainant received some of his personal information — far in excess of the 30-day time limit and thus contrary to subsection 8(3) — the Assistant Commissioner deemed that the company had refused the request, as per subsection 8(5), and was in contravention of Principle 4.9.
• With respect to the fee, while she acknowledged that the company had informed the complainant of the approximate cost of responding to the request, the Assistant Commissioner did not consider the amount minimal. Although the Act does not define "minimal," as it is followed by the phrase "or no cost," the implication is that the fee should be a token one. The Assistant Commissioner did not think $1,500 was token, and therefore found the company in contravention of Principle 4.9.4.
• Finally, based on the Office's review of the company's documentation, the Assistant Commissioner determined that some of the complainant's personal information had not been provided to him. She therefore found the company in contravention of Principle 4.9.

The Assistant Commissioner concluded that this complaint was well-founded.

Further Considerations

Finally, the Assistant Commissioner commented on the two issues raised by the respondent during the investigation. With respect to the view that the complaint was an attempt to circumvent the disclosure and production rules under the Rules of Civil Procedure, the Assistant Commissioner noted that the scope of discovery is different from the scope of an access to personal information request under the Act. Discovery requires each party to a proceeding to disclose before trial all of the facts and information that it is aware of and that are relevant to the issues in the lawsuit. The Act grants a right of access to all personal information about an individual held by an organization, subject to certain exceptions, whether relevant or not. The Assistant Commissioner maintained that documents received through discovery cannot be considered sufficient to meet the requirements of an access request under the Act.

Regarding the company's concerns about providing minutes from board meetings to the complainant, the Assistant Commissioner reminded the organization that the Act provides for exceptions to the right of access to one's personal information, which are outlined in section 9, noting in particular the provision regarding confidential commercial information.

She recommended that the company examine its records and provide the complainant with access to all of his personal information collected, used or disclosed during the time period requested, subject to any exceptions.

The Assistant Commissioner noted that she remained skeptical that no single member of the board of directors took notes during the meetings when the decision to terminate the complainant's employment and his ensuing lawsuit were discussed. She recommended that the company confirm with all staff members and directors that no notes, e-mails or other material collected and retained contained the complainant's personal information. The Assistant Commissioner asked that the company report back to her to confirm what actions it had taken in response to the complainant's allegations.