Access to personal information held by insurance company facilitated through the early resolution process
Early Resolved case summary #2017-002
August 27, 2017
Lessons Learned
- Upon request, an organization must provide an individual with access to their personal information, subject to exemptions listed in PIPEDA related, for example, to “confidential commercial information” and the personal information of third parties. If an organization can, however, address this problem by striking or severing portions of the information, an organization must give the individual access to the rest of their personal information.
- Where possible, flexibility should be shown and alternative solutions should be considered by both individuals and organizations in the fulfillment of an access request.
- Viewing a record without also getting a copy of it can meet an organization’s access obligations under PIPEDA. For further information, consult our guidance document Responding to access to information requested under PIPEDA.
Complaint
An individual was injured at a store. Following this incident, the individual requested access to her personal information held by the store’s commercial insurance company, including a copy of the insurance claim file and access to the video as well as documentation related to the incident. The company provided the individual with a copy of an incident report.
The company refused to provide her with access to its case management notes, claiming that they were confidential internal documents, constituting “confidential commercial information” as defined in paragraph 9(3)(b) of PIPEDA, and were not released to claimants. It further refused to provide her with access to the video of the incident, stating that it contained the images of a number of store employees and customers.
As a result of this refusal, the individual filed a complaint with our office seeking assistance with obtaining a copy of her claim file, as held by the company.
Summary of investigation
Despite the individual’s request for a copy of the video, the company was reluctant to release it. The Early Resolution Officer (ERO) contacted the company and suggested that it allow the individual to view the video. The company arranged for the individual to view the video, including assisting with transportation and finding a neutral location for viewing. The individual viewed the video.
The individual continued to insist on being provided with access to the company’s case management notes. However, the company was reluctant to provide complete access to all of the notes as they contained some information considered to be “commercial confidential information”. The notes also contained the personal information of third parties, as well as information that was not the personal information of the individual. Following discussion with the ERO, the company indicated that it was willing to provide the individual with redacted notes. The ERO offered to view both the original notes and the redacted version to ensure that the redactions were properly applied. Following a discussion with the ERO, the company made changes to the redacted copy of the notes and the ERO provided the individual with a copy of the amended redacted notes.
Outcome
As a result of solutions identified through the early resolution process, the company was provided with guidance on giving individuals access to their personal information. The individual received a redacted copy of the notes and access to the video. The complaint was considered early resolved.
- Date modified: