Jet Airways says possibility of litigation allows it to refuse access to personal information

PIPEDA Report of Findings #2017-008

August 17, 2017

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”)

1. The complainant alleged that Jet Airways (the respondent) did not provide complete access to her personal information. Specifically, the complainant alleged that the respondent did not provide her access to all documents, notes and internal and external correspondence relating to an incident that occurred onboard an aircraft.

Summary of Investigation

The Incident

2. The respondent is an airline based in Mumbai, India, which operates passenger flights to and from Canada. According to the respondent, it is registered as an extra-provincial company in British Columbia pursuant to the Business Corporations Act, SBC 2002, c. 57.
3. At the beginning of 2015, the complainant and a companion, who are disabled, purchased round-trip airfare from the respondent.
4. On departure day, after boarding the plane, a flight crew member advised the complainant and her companion that they were required to have their service dogs muzzled.
5. The pair responded that they had no muzzle for their service dogs, that muzzling services dogs was not required according to the respondent’s policies, and that a muzzle would hinder a service dog in performing its duties. The flight crew member repeated the request.
6. The complainant and her companion were ultimately asked to leave the aircraft, and were escorted off the aircraft and back to the terminal by the police.

Access Request

7. Subsequent to the incident, the complainant and her companion sought compensation from the respondent for having been denied boarding. While discussions with the respondent around compensation were ongoing, the complainant made a written request to access her personal information under the respondent’s “direct and/or indirect control” relating in any way to her booking, including, but not limited to:
   1. her complete Passenger Name Record (the “PNR”) and/or PNR history; and
   2. all documents, notes and internal and external correspondence relating to the incident.
8. The complainant sent a follow-up email to the respondent as 30 days had passed since the complainant sent her access request to the respondent and she still had not received any information. The complainant enquired as to whether the respondent intended to comply with its obligations under the Act, and if so, by what date she would receive the records.
9. Two days later, the respondent’s Canadian counsel advised the complainant that her request had been forwarded to the respondent, but he had not yet received instructions from the respondent. He indicated that he would pursue the matter with the respondent.
10. About two weeks later, the complainant submitted a complaint to the Office of the Privacy Commissioner of Canada (the Office) regarding the respondent’s lack of response to her access request.
11. A few days later, the complainant’s representative wrote to the respondent to formally request compensation for the incident. This request was reiterated in a subsequent letter, and included a request for:
    1. denied boarding compensation in cash or equivalent;
    2. compensation for one prepaid night at a hotel; and
    3. compensation for pain and suffering, including injury to dignity and self-respect.
12. In this subsequent letter, the complainant’s representative noted that if the matter was not fully resolved within 30 days, he had been instructed to file a complaint with other regulatory agencies.
13. The complainant later filed a complaint against the respondent with another regulatory agency, which was ongoing at the time of writing this report.

Early Resolution

14. Our Office initially attempted to resolve the complaint by way of early resolution and encouraged the respondent to respond to the complainant’s access request. After further communications between the parties, the respondent eventually provided the complainant with a complete copy of her PNR. However, it refused to provide any other notes or documents relating to the incident on the basis that the information was confidential and had been gathered as part of its investigation of the incident.
15. While the complainant was satisfied that she had obtained the materials relating to her PNR, she believed that the respondent still had materials in its possession that had not been provided to her, specifically:
    1. the Departure Control System Report for the day in question;
    2. materials relating to the police’s involvement on the day in question;
    3. materials relating to the hotel accommodations provided to the complainant on the day in question; and
    4. materials relating to the respondent’s internal investigation that occurred on the day in question.
16. Given that the parties could not agree on a mutually acceptable resolution, the complaint was transferred to a formal investigation.

Preliminary Report of Investigation

17. After gathering the facts underlying the complaint and obtaining representations from the complainant’s representative and the respondent, our Office issued a Preliminary Report of Investigation (PRI) in this matter. Both parties responded to the PRI and their responses were considered in the preparation of this report (please refer to the Preliminary Report of Investigation and the Respondent’s Response section, starting at paragraph 62 below).

Jet Airways Representations

18. Our Office received several submissions from the respondent detailing how it had responded to the access request and the exemptions under the Act it believed permitted it to refuse providing any further information to the complainant.
19. In particular, while the respondent confirmed it had provided the complainant access to her PNR, it stated that it would not be able to provide any further information, such as materials related to the incident, due to paragraphs 9(3)(a) and 9(3)(d) of the Act (see relevant sections below).

(i) Timeliness of Response

20. With respect to the respondent’s failure to respond to the access request within the prescribed 30-day time period, the respondent advised our Office that it did not do so since it was “apprehending this issue being spilled over into court, as specified by the complainant in their legal notices”. Also, the respondent had not notified of an extension within 30 days of the access request, as the “information requested was directly sent to our lawyers and company representatives…it was presumed to be confidential and privileged under section 9(3)(a).”
21. After our Office issued its PRI in this matter, the respondent also indicated, for the first time, that one of its staff had been on medical leave when the access request was received, which prevented it from responding in a timely fashion to the request. Additionally, the respondent indicated that before it could share the required information, the complainant had sent notices referring to potential proceedings before another regulatory agency. As such, the respondent considered this to be a “formal legal notice”, which entitled it to withhold the information that had been requested. The respondent also noted that, in any event, the complainant had already obtained access to the police occurrence report relating to the incident through other means.

(ii) Paragraph 9(3)(a) - Solicitor-Client Privilege

22. The respondent stated that paragraph 9(3)(a) of the Act applied to the documents cited above in paragraph 15 as the documents were internal, confidential, and were covered either by legal advice or litigation privilege. In particular, the respondent pointed to the complainant’s demand for compensation and the correspondence sent by the complainant’s representative which referred to the potential for legal proceedings. The respondent took the view that litigation between the parties was a distinct possibility and that if it disclosed the requested documents, they would be used against it, particularly in proceedings before another regulatory agency.
23. In support of applying paragraph 9(3)(a) to the access request, the respondent submitted two Court decisions it considered directly applicable. First, the respondent referred our Office to the Federal Court decision in Privacy Commissioner of Canada v. Air Canada (“Air Canada”) which, among other things, considered whether an incident report created by Air Canada in relation to an onboard incident was subject to litigation privilege. The respondent submitted that, similar to its case, an “incident which arises onboard a flight could result in either of the parties instituting various proceedings against the passenger, or vice versa,” and as a result, “comes within the category of privileged documents.”
24. The respondent also referred our Office to the Supreme Court’s decision in Privacy Commissioner of Canada v. Blood Tribe Department of Health (“Blood Tribe”) and Air Canada for the proposition that our Office neither had the authority to compel an organization to produce documents over which a claim of solicitor-client privilege had been made, nor to verify organizations’ claims of privilege at first instance.
25. To obtain further clarification over the nature of the documents that the respondent was withholding, our Office requested, on a voluntary basis, basic information from the respondent about the documents such as the author, date, recipient and purpose for each relevant document that had been withheld. However, the respondent declined to provide this information.
26. In addition, the respondent informed our Office that it was policy for the organization to treat every incident with the assumption that litigation could occur. Specifically, any document created as a result of an incident is transferred to a separate file, marked ‘counsel’ and forwarded to its legal division. The respondent noted that this procedure does not prevent the organization from resolving issues.
27. Our Office received a copy of the respondent’s policy but could not find any reference regarding the presumption of litigation every time an incident occurred. When questioned, the respondent stated that:

    “as a matter of process being followed at our end, any grievance addressed by the complainant to the guest relation and all further correspondence and communication undertaken internally with respect to the same are deemed to be considered Privilege [sic] and confidential as there is all probability that it may spill over to a litigation in future. Hence to avoid duplications of the statements as a general practice, Jet Airways do not explicitly label it as Solicitor-Client Privilege documents in their communications.”

28. In response to our Office’s PRI, the respondent claimed that it did not invoke litigation privilege over all documents generated in relation to an onboard incident. Nevertheless, it submitted that once it had been notified of the potential for legal proceedings – as it had been in this case – it was entitled to invoke litigation privilege.

(iii) Paragraph 9(3)(d) - Formal Dispute Resolution

29. The respondent stated that paragraph 9(3)(d) of the Act also applied to the documents cited in paragraph 15 as the respondent was trying to resolve the issue through its internal processes. As a result, the respondent advised our Office that it did not provide a reason for withholding access to each piece of the complainant’s personal information as “all correspondence and communications” were created in the “formal dispute resolution process under section 9(3)(d).”
30. To obtain further clarification on this exemption, our Office requested policies and procedures that would demonstrate the respondent’s formal dispute resolution process, and how it was applied to this particular complaint. The respondent stated that the complaint was handled through “a series of correspondence exchanged between various departments of the company, such as Guest Relations team, Airport Station team after the incident. All the mails exchanged internally between these departments are deemed to be part of the formal dispute resolution process and hence are privileged and to be exempted under clause 9(3)(d) of…PIPEDA.”
31. The respondent also directed our Office to a “grievance redressal mechanism”, which can be found on its website. This section indicated that if a complaint cannot be resolved satisfactorily, an individual may escalate the complaint to a “Nodal Officer” and an “Appellate Authority”. The respondent advised that through this internal process, “all the emails exchanged are privileged as they were part of the formal dispute resolution process.” No other policies or guidelines were provided.

The Complainant’s Representations

32. The complainant’s representative argued that the respondent was conflating solicitor-client privilege and litigation privilege. He submitted that, because paragraph 9(3)(a) of the Act does not refer expressly to “litigation privilege”, Jet Airways was not entitled to rely on it. He also argued that the Federal Court’s decision in Air Canada was wrongly decided as it ignored the ordinary meaning of paragraph 9(3)(a).
33. In any event, the complainant’s representative was of the view that the respondent had failed to meet the tests for either litigation privilege or solicitor-client privilege. With respect to the latter, he submitted that there was no indication that the documents identified in paragraph 15 involved communications between the respondent and its solicitors.
34. With respect to litigation privilege, the complainant’s representative submitted that the documents were not prepared for the “dominant purpose” of litigation. He also cited the British Columbia Supreme Court’s decision in Smith v. Air Canada, which held that litigation privilege did not apply to a report prepared by Air Canada as a result of an onboard incident.
35. Regarding paragraph 9(3)(d), the complainant’s representative stated that the documents were not generated within a “formal dispute resolution process” in the manner that this Office interpreted that phrase in PIPEDA Report of Findings #2016-006. Further, the documents at issue were generated on or about the date of the incident and the complainant and the respondent were not involved in a formal dispute resolution process at that time.

Application

36. In analyzing the facts, we applied subsections 8(3), 8(4), 8(5), 8(7) and paragraphs 9(3)(a) and 9(3)(d) of the Act, as well as Principles 4.1.4 and 4.9 of Schedule 1 of the Act.
37. Principle 4.1.4 of Schedule 1 states that organizations shall implement policies and practices to give effect to the principles contained in Schedule 1, including:
    1. implementing procedures to protect personal information;
    2. establishing procedures to receive and respond to complaints and inquiries;
    3. training staff and communicating to staff information about the organization’s policies and practices; and
    4. developing information to explain the organization’s policies and procedures.
38. Principle 4.9 of Schedule 1 states that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information.
39. Subsection 8(3) of the Act states that an organization shall respond to a request under Principle 4.9 with due diligence and in any case not later than 30 days after receipt of the request.
40. Subsection 8(4) allows an organization to extend the time limit under specific circumstances, requiring the organization to send notice of the extension to the individual, no later than 30 days after the date of the request, to advise of the new time limit, the reasons for extending the time limit, and of the individual’s right to make a complaint to our Office.
41. Subsection 8(5) of the Act states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.
42. Subsection 8(7) of the Act states that an organization that responds within the time limit and refuses a request shall inform the individual in writing of the refusal and set out the reasons and any recourse that the individual may have under Part 1 of the Act.
43. Paragraph 9(3)(a) of the Act states that an organization is not required to give access to personal information if the information is protected by solicitor-client privilege or, in civil law, by the professional secrecy of lawyers and notaries.
44. Paragraph 9(3)(d) of the Act states that an organization is not required to give access to personal information if the information was generated in the course of a formal dispute resolution process.

Analysis

Timeliness of Response

45. In this case, the respondent appears to have been of the view that because it was entitled to withhold the information requested, it did not need to respond to the complainant’s access request. However, subsections 8(3) and 8(7) make clear that even if an organization believes it is entitled to refuse the request, it must nevertheless respond to the request within the time limits set out in section 8 and provide the reasons for the refusal.
46. In our view, the fact that a member of the respondent’s staff may have been on medical leave does not excuse it from its legal obligations under the Act. The respondent is responsible for ensuring that it has appropriate arrangements, at all times, to comply with its legal obligations under the Act. Further, the Act, in subsection 8(4), provides for an extension up to a maximum of 30 days in circumstances specified in the provision, along with notification requirements prescribed in the Act.
47. The respondent did not respond to the complainant’s access request within the 30-day timeframe established by the Act, nor did the respondent send the complainant a notice of an extension within 30 days. No information was communicated to the complainant within the prescribed timeframe.
48. Accordingly, it is our finding that the organization contravened subsection 8(3), and pursuant to subsection 8(5) of the Act, is deemed to have refused the request.
49. Despite missing the 30 day time limit, and the deemed refusal to provide access, the respondent eventually provided the complainant with her PNR. It also appears that the complainant separately obtained a copy of the police occurrence report. However, the respondent continues to withhold documents that are listed at paragraph 15 on the basis of paragraphs 9(3)(a) and 9(3)(d) of the Act.

Solicitor-Client Privilege/Litigation Privilege

50. The complainant’s representative submitted that paragraph 9(3)(a) does not encompass litigation privilege. However, in our view, we are bound by the Federal Court’s decision in the Air Canada case, which found that paragraph 9(3)(a) did encompass litigation privilege. Furthermore, in Blank v Canada (Minister of Justice), the Supreme Court made clear that the term “solicitor-client privilege” in a statute is broad enough to encompass “litigation privilege” even though the two concepts are distinct.
51. With respect to the respondent’s reliance on paragraph 9(3)(a), our Office attempted to obtain basic details from the respondent regarding the documents being withheld pursuant to paragraph 9(3)(a). However, their respondent did not provide the requested details.
52. Our Office also attempted to clarify with the respondent in what circumstances it claimed solicitor-client privilege and litigation privilege. The respondent initially indicated that it was internal policy for the organization to treat every incident as if potential litigation could occur, therefore, all documents and information created as a result were protected under solicitor-client or litigation privilege. While the respondent provided a policy to our Office, we were unable to find specific reference to this assertion. Our Office requested, multiple times, clarification regarding the claim of solicitor-client privilege and materials that determined and documented the application of such privilege; however, no further information was provided by the respondent.
53. In our view, a blanket policy applicable to all documents generated from onboard incidents would not meet the tests for solicitor-client privilege and litigation privilege. Not every document that is prepared in response to an onboard incident will be for the dominant purpose of litigation or involve a solicitor-client communication. Such a policy would, in all likelihood, lead to privilege claims that are overbroad, and therefore in contravention of the respondent’s obligation to provide access to personal information under the Act.
54. While the respondent no longer maintains its position that all documents generated as a result of an onboard incident are subject to litigation privilege, it has submitted that it was entitled to claim litigation privilege once the “legal notice” was issued. In our view, such a position is also problematic as it means potentially claiming litigation privilege for documents that were created prior to a “legal notice” being received and which were not created for the dominant purpose of litigation that is reasonably contemplated.
55. We are therefore of the view that the respondent is contravening Principle 4.1.4 by failing to adopt policies and practices that give effect to the principles in Schedule 1, specifically Principle 4.9 in this case.
56. However, in light of the Blood Tribe and Air Canada decisions, which are binding on our Office, we are unable to investigate further what documents are at issue and whether information contained within them meets the tests for litigation or solicitor-client privilege. As such, we are unable to make a finding as to whether the respondent was entitled to withhold the complainant’s personal information pursuant to paragraph 9(3)(a).

Formal Dispute Resolution Process

57. The respondent also stated that it could not provide any further information, including the four categories of outstanding documents referenced in paragraph 15 of this report, as they were generated in a formal dispute resolution process.
58. In PIPEDA Report of Findings #2016-006, our Office took the position that, for something to qualify as formal dispute resolution, the process must be more than mere dispute resolution. Thus, a formal dispute resolution process, as distinguished from a simple dispute resolution process, suggests the presence of a framework, either legislated or agreed to by the parties to the dispute. It also suggests a process that takes place in accordance with recognized rules.
59. In this case, the respondent has not provided any specific details to support its claim that its attempts to resolve the dispute with the complainant constitute, or were conducted within, a formal dispute resolution process. While the respondent refers to “a series of correspondence exchanged between various departments of the company”, there is nothing to suggest that this is anything more than an informal process adopted by the respondent to respond to customer complaints. It is not unusual that a complaint received by an organization could involve various departments and, therefore, points to a generic complaint handling practice.
60. Regarding the respondent’s complaint redressal process, it is our Office’s view that this also does not constitute, or form part of, a formal dispute resolution process. Rather, this mechanism simply allows an individual the ability to escalate a complaint internally if a complaint has not been initially resolved satisfactorily. In our view, this is simply an extension of the respondent’s internal complaint system. We therefore do not see this as a formal dispute resolution process that is either legislated or agreed to by the parties to the dispute and that takes place in accordance with recognized rules. In fact, as demonstrated with the creation of the complaint redressal process, the respondent retains considerable flexibility as to the kind of internal processes it adopts.
61. Therefore, regarding the exemption afforded in paragraph 9(3)(d) of the Act, our Office is of the view that this exemption does not apply in the circumstances.

Preliminary Report of Investigation and the Respondent’s Response

62. In the PRI, our Office recommended that the respondent reconsider its application of paragraph 9(3)(a) of the Act and to release any documents that were not covered by solicitor-client or litigation privilege. In response, the respondent maintained its claim that paragraphs 9(3)(a) and 9(3)(d) applied to the documents in question.
63. Our Office also recommended that the respondent revise its policy of applying paragraph 9(3)(a) to every document generated in respect of an incident, as soon as it occurs, in order to bring itself into compliance with Principle 4.1.4. As noted above, the respondent now states that this is not its policy. However, we remain concerned that the respondent applies litigation privilege to all documents relating to an incident, regardless of the circumstances of their creation, once it is notified of potential litigation.
64. With respect to access requests, our Office recommended that the respondent put in place procedures to respond to access requests in accordance with the requirements of the Act. We recommended that these procedures should make clear that the respondent is required to respond to access requests in accordance with the timeframe and notification requirements specified in the Act, even in cases where it believes it is entitled to refuse access under an exemption set out in the Act.
65. The respondent did not make changes to its procedures. We remain concerned that the respondent may not fully recognize or respect its obligations under the Act with regard to responding to requests for access to personal information.

Conclusion

66. Accordingly, our Office finds this complaint to be well-founded with respect to subsection 8(3) of the Act and Principle 4.1.4. Our Office also finds the complaint well-founded with respect to the improper application of paragraph 9(3)(d).
67. Regarding whether the complainant’s personal information was properly withheld pursuant to paragraph 9(3)(a) of the Act, our Office is unable to issue a finding and reports an impasse over privilege.
68. Our Office continues to take the position that the respondent:
    1. put in place procedures to respond to access requests in accordance with the time limits and requirements of the Act;
    2. review the documents and information that it may be withholding, as relating to the access request under reference here, and release any that are not properly covered by solicitor-client or litigation privilege;
    3. review its policy for applying paragraph 9(3)(a) of the Act so as to ensure that it is not making privilege claims that are overbroad; and,
    4. review its policy for applying paragraph 9(3)(d) of the Act so as to ensure that it is applied properly and in accordance with the Act.
69. Our Office has a continuing interest in the respondent complying with the Act. Given the unresolved nature of this complaint, upon issuance of this report, our Office will consult and consider its authorities under the Act towards achieving compliance with our recommendations.