Company must not charge flat fee to process access request

PIPEDA Case Summary #2008-391

[Section 2, paragraphs 8(6)(a) and (b); and, Principles 4.9 and 4.9.4 of Schedule 1]

An individual requested a copy of his job-related personal information held by a company.  The company maintains a database on people who are employed or have been employed in a particular trade.  Its members are businesses who employ such tradespeople.  For a monthly fee, members can access the company’s database, both to provide and to obtain job performance reports about these individuals.  In addition, tradespeople can obtain copies of their own reports for a fee.  In this instance, an individual objected to paying the fee for his report and complained to this Office.

The Assistant Commissioner found that the fee was not intended to recoup the company’s costs of gathering the information and was by no means the company’s main source of income.  Nevertheless, it appeared to be a flat fee that could have the effect of dissuading individuals from accessing their personal information.  In addition, since the amount of the fee charged to individuals was not substantially less than the fee charged to the company’s business members, the Assistant Commissioner determined that the fee was not reasonable.  

The following is an overview of the investigation and the Assistant Commissioner’s deliberations.

Summary of Investigation

The company collects and stores comprehensive relevant information on individuals who have been employed in a specific trade.  It maintains a national database of such information, which its members (businesses who employ these individuals) may access for a monthly fee.  Individuals must consent to their personal information being collected and disclosed by the company.

An individual requested a copy of his job performance report held by the company in its database.  In response, the organization sent him a form to complete and requested $14.50 for a copy of the report.  He did not comply with these requirements and instead wrote a second time to request his information.  The company’s reply reiterated that he had to complete the form and pay the fee before it could send the information to him.

In its representations to this Office, the company claimed that it does not collect personal information, only information related to qualifying individuals for trade-related positions.  It stated that, when an individual requests a copy of his or her work history report, there is no fee charged for the information contained therein.  Rather, the $14.50 fee covers administrative costs and is intended to encourage only serious requests.

The organization described the work involved in handling an individual’s request for his or her report.  When a person telephones the company, a staff member could spend from 5 to 20 minutes talking with the individual.  The request form is then faxed to the caller.  When the company receives the completed form, staff process the request and mail the report.  Often the individual follows up with a telephone call in order to get an explanation of the report—this can take up to 30 minutes of staff time.  The organization estimates that, when costs such as printing and personnel time are considered, the true cost of handling these requests is around $60 or $70, rather than $14.50.

An individual cannot simply view a copy of the report on-line, as opposed to having to obtain a paper copy.  The company indicated that it has not established such an on-line system since it would be too costly. 

The company’s privacy policy states that, upon request and with appropriate identification, individuals are able to review their personal information on file and correct or amend it as necessary.  No mention is made of a fee.

In this case, the company is also subject to the privacy legislation of the province in which its headquarters is based.  However, because of the trans-border nature of the commercial activity, this Office had jurisdiction over the complaint as interprovincial commercial activity falls under the Act.

Findings

Issued February 25, 2008

Application: Section 2 defines personal information as “information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.”  Paragraphs 8(6)(a) and (b) state that an organization may respond to an individual’s request at a cost to the individual only if the organization has informed the individual of the approximate cost; and the individual has advised that the request is not being withdrawn.  Principle 4.9 stipulates that, upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.  Principle 4.9.4 states that an organization shall respond to an individual’s request within a reasonable time and at minimal or no cost to the individual. 

In making her determinations, the Assistant Commissioner deliberated as follows:

• The company contended that it does not collect personal information, only information related to qualifying individuals for trade-related positions.  The Assistant Commissioner noted that information about an individual’s work history, (i,e., former employee’s safety record) is information about that individual and is, therefore, personal information as defined in section 2.  Contrary to the company’s view, she therefore concluded that the information it collects qualifies as personal information under the Act.
• When the complainant requested access to his personal information, namely his job history report, the company advised that he had to pay a fee of $14.50 in order to obtain a copy, in keeping with paragraphs 8(6)(a) and (b) of the Act. 
• The Assistant Commissioner recognized that, in past cases concerning fees, the Office has always been mindful that, while Principle 4.9.4 does not define the term “minimal,” it is followed by the phrase “or no cost.”  This would imply that any fee charged should be a token one.
• She also noted that the Act does not oblige an organization to provide copies of personal information; rather, it requires organizations to provide access to such information.  However, in this instance, the alternative, which is to allow individuals to view their reports on-line, would be unpractical and costly to set up.  In any event, most individuals would likely still want copies for their records.
• The Assistant Commissioner took into consideration that, in some past cases, the Office has accepted that a fee for photocopying may be charged.  However, the Office has not accepted the charging of a flat fee at the time of the request before the information has been provided, as it could have the effect of dissuading an individual from making a request. 
• In this case, she believed that the company was attempting to charge a fee for the time and effort to address the request and any subsequent questions.  The fee, however, likely did not fully recover the company’s costs in carrying out these activities.  The company admitted to charging the fee in part to encourage only serious inquiries.  Given this, the fee would appear to be a flat fee that could have the effect of dissuading individuals from requesting the information. 
• Therefore, the Assistant Commissioner determined that the company was contravening Principle 4.9.4 by requesting the fee.  Although the amount of $14.50 was not intended to recoup the costs of gathering the information and was by no means the main source of income for the organization, it nonetheless appeared to be a flat fee that could have the effect of dissuading individuals from accessing their personal information.  Furthermore, the fee did not appear to be a reasonable one as it was not substantially less than the one the company charged its business members.
• Before issuing her findings in the complaint, the Assistant Commissioner recommended that the company cease charging a flat fee.  Despite attempts to follow up with the company, no response was received to the preliminary report and recommendation.

The Assistant Commissioner therefore concluded that the complaint was well-founded.

Following the conclusion of the complaint investigation and the issuance of the Assistant Commissioner’s findings, the company decided to implement her recommendation.

See also

#283 A bank charged fees to process requests for personal information

#341 Fees and the role of a medical practitioner considered in denial of access complaint

#354 Fees for access questioned