Airline broadens interpretation of personal information and improves handling of personal information access requests

PIPEDA Case Summary #2007-370

[Section 2; Principle 4.9]

A customer of an airline, who had been embroiled in a dispute with the airline over a baggage handling incident, was unimpressed with the airline’s response to his request for access to his personal information. The airline told him that the only personal information it held about him was his name, address and telephone number.  The rest of the information, it said, was not directly related to his personal information.

During the investigation, the Office worked with the airline to help it better understand the definition of personal information and to improve its handling of personal information access requests. As a result, the organization released additional information to the complainant, and provided him with an explanation of how his information was handled. The Assistant Privacy Commissioner accordingly considered the matter resolved.

The following is an overview of the investigation and the Assistant Commissioner’s deliberations.

Summary of Investigation

The complainant wrote to the airline, asking for access to all of his personal information held by the airline in relation to his complaint regarding the baggage handling dispute. In the airline’s response, it stated that the only personal information it held was his name, address and telephone number. The rest of the contents on its files contained information “not directly related” to his personal information, and was therefore not provided to him.

The complainant initially indicated that he did not want to receive copies of correspondence between himself and the airline. What he was seeking were any internal documents that pertained to his complaint. He wanted to know how his complaint was handled and whether any of the baggage handlers had been disciplined.

The airline provided the Office with the information it held about the matter. The information consisted of correspondence between the two parties and a travel itinerary that the complainant had provided to the airline. There were no documents pertaining to disciplinary measures against the baggage handlers, nor were there any documents exchanged between the airline and the baggage handling company. According to the airline, it did not exchange any information about the complainant with the baggage handling company, and it had no responsibility for disciplining any of the other company’s employees.

It was clear, however, to the Office that the airline was too narrowly interpreting the scope of “personal information,” and asked it to review its files again. This time, the airline found a number of e-mails pertaining to the complainant’s dispute. One referred to the incident, noting that the matter would be forwarded to the baggage handling company. The others referred to phone messages and correspondence from the complainant, as well as the airline’s offer to clean his luggage. There was no reference to an “investigation” into his complaint.

We had noted in these messages references to “reports” and “resumés.” The airline employee who used this terminology clarified that she was referring to the e-mails and telephone calls as “reports.” The “resumé,” she stated, was the complainant’s letter, with his personal identifiers removed, that had been sent to various parties involved in responding to his complaint.

The complainant decided that he did not want any copies of the e-mails, but that he would like a copy of the depersonalized letter and any covering correspondence or transmission sheet, and any written response to him. The airline did so, and explained to him that a copy of the depersonalized letter was given, by hand, to the baggage handling company. This was the reason that there was no record of transmission between the airline and the other company.

Findings

Issued January 12, 2007

Application: Principle 4.9, which states that, upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 2 defines personal information as “information about an identifiable individual.”

In making her determinations, the Assistant Commissioner deliberated as follows:

• The airline’s initial response to the complainant reflected a lack of understanding with respect to what personal information is and how to provide access to it. She noted that the definition is broad and includes more than just identifiers, such as an individual’s name, address or telephone number.
• The investigation established that the contents of the airline’s files contained the complainant’s personal information, in the form of letters to and from him concerning his dispute. To say that it did not have information directly related to his personal information was not only semantically confusing, it was incorrect.
• It was therefore clear to the Assistant Commissioner that the airline had not made an effort to truly address his request. She noted that when an organization responds to a request for access to personal information, it should give an indication of where it looked for the requestor’s information and the types of information it holds.
• Principle 4.9 explicitly mentions the “existence, use or disclosure of personal information.” The rest of the clauses that follow elaborate on the requirements of organizations to be forthcoming in providing details regarding the sources of information and to whom information has been disclosed.
• There was no indication in the airline’s first response that a search had even been conducted until after the complainant approached the Office and we became involved.
• The airline did hold more information about the complainant than merely his name, address and telephone number. It did not, however, have the information he was seeking, namely, a report outlining the details of and investigation into his complaint, and any subsequent action taken.
• Although he did not initially want correspondence between him and the airline, he asked that certain information be provided to him. The airline did so, and, at the same time, provided him with an explanation regarding the handling of his complaint.

Satisfied that, with this action, the airline had met its obligations under Principle 4.9, the Assistant Commissioner concluded that the complaint was resolved.