Business learns that it must have a privacy policy available to the public

Settled case summary #18

Complaint

An individual wrote to a business requesting his personal information, as well as a copy of its privacy policy. He complained that the organization not only withheld some of his personal information, but also its privacy policy.

Outcome

The complainant was initially told by the business that he was not entitled to any of his information that pre-dated January 1, 2004, which is the date the business became subject to the Personal Information Protection and Electronic Documents Act (the Act).  After the complainant refuted this, the organization provided him with the remainder of his information, but not its privacy policy.  Our Office learned that the organization had no privacy policy.  At our request, the business subsequently drafted its own policy.

The organization gave a copy of its newly minted policy to the complainant, who considered the matter to be settled.