Airline delays granting access to personal information, citing ongoing litigation

PIPEDA Case Summary #2006-352

[Principle 4.9 of Schedule 1, subsections 8(3) and 8(5), paragraph 9(3)(a)]

An individual complained that an airline denied him access to his personal information.  The airline had banned him from flying with it, and he had requested information concerning the events of a specific date that had led to the ban. He had also initiated legal proceedings against the airline.

The Assistant Commissioner conceded that the airline ultimately provided the complainant with his information. However, she was concerned that his requests for access to his personal information were not handled as requests under the Act, and the airline ignored its responsibility to respond in the manner stipulated by the Act. She asked the company to acknowledge its obligations under the Act to respond to such requests, notwithstanding any legal action that may be taking place concurrently. The airline refused, and the Assistant Commissioner decided to pursue the matter in accordance with the Office’s authorities under the Act.

At first, the organization refused to implement the Commissioner’s recommendations and the matter was referred to the Commissioner’s litigation counsel. Shortly after commencing an Application in the Federal Court per section 15 of the Act, the organization agreed to implement the recommendations, thus avoiding the need to follow through with the litigation.

Summary of Investigation

The complainant’s brother wrote to the airline on his behalf to protest the ban the company had imposed on the complainant and to request compensation. In the letter, he asked the airline to indicate how it had determined that his brother posed a risk to the safety and comfort of its passengers and crew. In its response, the airline indicated that the Act prevented it from disclosing personal information to a third party.

A few days later, the complainant faxed the airline his consent for the release of his personal information to his brother. He also requested access to information requested in his brother’s letter. The fax was considered to be the first of two access requests made by the complainant.

On the same date as the complainant’s fax, the airline wrote to him in response to his brother’s earlier letter. It explained that, notwithstanding the brother’s arguments, the ban stood, as the company continued to believe that the complainant posed a threat to the safety of passengers, crew or to the safe operation of an aircraft.

The airline maintained that its letter was also in response to the complainant’s faxed access request. However, only the brother’s earlier letter was mentioned in the opening paragraph. According to the airline, it answered all the points the complainant and his brother had raised, including the request for information, and it had nothing further to provide.

Following this exchange of correspondence, the company turned the matter over to outside counsel to handle the lawsuit that the complainant had filed against it. The company did not communicate directly with the complainant again until the ban on his flying with the airline was lifted.

Before the ban was lifted, the complainant again wrote to the company requesting all information the airline possessed with regard to him and to the events of a specific date, as well as the information requested in his brother’s letter.

More than a year after the complainant’s initial request, the company provided some information to the complainant’s brother via outside counsel. This included his Personal Name Record, which mentions the specific incident that led to the ban, and the statements of three witnesses to the incident. The airline withheld some information that it considered to be protected by solicitor-client privilege.

The airline confirmed that it had no other documents concerning the incident in question. Given the short time frame (one day) between the incident and the flying ban, some information leading up to the ban was exchanged verbally over the telephone.

Findings

Issued September 8, 2006

Application: Subsection 8(3) states that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Under subsection 8(5), if the organization fails to respond within the time limit, the organization is deemed to have refused the request. Principle 4.9 affirms that an individual shall be given access to his or her personal information. Paragraph 9(3)(a) allows an organization to withhold personal information if the information is protected by solicitor-client privilege.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• The complainant twice requested his personal information, following his brother’s initial letter. It took the airline over a year to provide access.
• Although it appeared that the company responded to the complainant’s requests for his information, the Assistant Commissioner was of the view that the airline chose to focus on the legal claim that he had filed and disclosed information to him in the context of that process, not in response to his access requests, and not within the time limits under subsection 8(3).
• After reviewing the information withheld under paragraph 9(3)(a), the Office informed the airline that some of it did not fall under solicitor-client privilege and should be released, which the airline did.
• The Assistant Commissioner conceded that the airline ultimately did provide the complainant with the personal information he had requested.
• Nevertheless, the Assistant Commissioner believed that the company did not process the complainant’s requests as requests under the Act, and thereby ignored its responsibility to respond to requests for access to personal information in the manner stipulated under Principle 4.9 and within the time frame outlined in subsection 8(3).
• The Assistant Commissioner recommended that the airline review its procedures for responding to personal information access requests under the Act.
• She also asked that the airline confirm that it acknowledges its obligation under the Act to respond to such requests, notwithstanding any legal action that may be taking place concurrently.
• The airline outlined its position that, when litigation commences, there are well-defined rules and procedures that govern the discovery of documents in civil suits. In its view, the Act is not meant to usurp those rules.
• While acknowledging its responsibilities under the Act, and its efforts to ensure compliance, the airline maintained that the complainant was trying to use the legislation to bypass established civil procedures and gain access to information gathered in contemplation of litigation.
• The airline therefore chose not to implement the Assistant Commissioner’s recommendations.

The Assistant Commissioner concluded that the complaint was well-founded. The Office informed the airline that it would be pursuing the matter in accordance with its authorities under the Act and referred the case to her litigation counsel. Shortly after commencing an Application in Federal Court per section 15 of the Act, the airline agreed to implement the recommendations.