Guidance on deemed denials under the Privacy Act

Guidance for Access to Information and Privacy Officers on Deemed Denials under the Privacy Act

Overview

Year after year, a substantial number of the complaints we get at the Office of the Privacy Commissioner of Canada come from individuals alleging that a federal institution unjustly denied them timely access to their personal information.

The Privacy Act gives individuals a general right to have access to their personal information held by federal institutions upon written request. Federal institutions are generally obliged to meet those requests, although there are exceptions.

The Privacy Act also directs institutions to deal with access requests within 30 days of receipt, although further extensions may, in certain circumstances, be permitted.

Timeliness in responding to access requests sends a message that federal institutions take such requests seriously. It also gives effect to what the Supreme Court of Canada has held to be a quasi-constitutional right. Indeed, from an individual’s point of view, waiting an unreasonably long time for information can be nearly as vexing as not getting the information at all.

Too often, however, institutions are not meeting the statutory deadlines, prompting individuals to file complaints with our Office.

Because service to individuals is our priority, we are working with Access to Information and Privacy (ATIP) Coordinators to find ways to speed up the processing of requests for access to personal information.

At the same time, we are also taking a firmer line on the concept of “deemed denials.” If a federal institution does not respond to a complainant's request for access to personal information within a set timeframe, institutions should expect that our Office will find at that the end of that period that access has been denied.

Once a delay is deemed to be a denial of access, the complainant — or the Commissioner — may pursue the matter before the Federal Court.

The Details

Section 12 of the Privacy Act gives all individuals, whether they are within or outside Canada, a general right of access to their personal information held by federal institutions. With specific exceptions, an individual should have access to:

1. any personal information about the individual contained in a personal information bank; and
2. any other personal information about the individual under the control of a government institution with respect to which the individual is able to provide sufficiently specific information on the location of the information as to render it reasonably retrievable by the government institution.

Individuals have a further right to request correction of their personal information if they believe it is inaccurate or incomplete. Where a requested correction is not made, individuals have a right to require that their personal information be so annotated.

There are exemptions to the general right of access provided by the Privacy Act, which are set out in sections 18 to 28 of the Act. For instance, the head of an institution may refuse to provide access to personal information obtained in confidence from another government, or that relates to a police investigation.

Timeliness

Section 14 of the Act obliges federal institutions to respond to access requests in a timely manner. Within 30 days of receiving a written access request, an institution has to write back to say whether it will give access to the information and, if so, it must produce the information.

There are some circumstances in which the institution may be entitled to an extension of that time limit. Section 15 states that a federal institution may extend the response deadline by a maximum of 30 days, if meeting the original time limit would unreasonably interfere with the institution’s operations, or if consultations are necessary to comply with the request and they cannot reasonably be completed within the original time limit.

The deadline may also be extended for a “reasonable” length of time if the personal information has to be translated or converted into an alternative format.

Right of Complaint

Under section 29 of the Privacy Act, our Office has a duty to investigate complaints under the Act, including complaints relating to refusals to provide access to personal information and unreasonable extensions of timelines.

When we receive such complaints, we open a file and an investigator communicates with the Access to Information and Privacy (ATIP) Co-ordinator of the relevant institution.

Helping Out

Because our mission is to ensure respect for the privacy rights of individuals, our investigators work hard to find ways to resolve people’s complaints in an expeditious and satisfactory way. In some cases, for instance, this could be as simple as ensuring that a request for access to personal information is as focused and specific as possible.

We recognize that some access requests are complicated because they involve several departments, third parties, or large amounts of personal information. In such cases, our investigators often work with the relevant ATIP officer to develop a work plan and a commitment date for the production of personal information.

New OPC Approach

However, people whose requests for personal information are neither fulfilled nor formally denied are in a kind of limbo: until they receive a clear-cut response, they cannot apply to the Federal Court to seek to have their rights enforced.

Therefore, in August 2011, our Office adopted a new approach under which we no longer engage in extended negotiations with ATIP officials with respect to timelines. 

When we receive a complaint that an individual has not been given access to personal information within the statutory time limits (or a written notice as to why access is being denied), or that an extension of the time limit is unreasonable, we ask the relevant ATIP Co-ordinator to provide a commitment date and/or a work plan for the production of the personal information requested, or for an explanation as to why access is being denied.

Our primary goal is to resolve the issue in a timely and efficient manner for all parties concerned by attempting to address the complaint informally via our Early Resolution process, which relies on negotiation and persuasion and a solid knowledge of past complaint findings. Where Early Resolution is not feasible, a formal investigation is conducted.

In the course of our investigation, the institution can expect our Office to issue a finding of “deemed denial” where it:

1. does not provide access to the personal information requested or its reasons for denying access within four months;
2. does not provide a commitment date or work plan within four months of the start of an investigation; or
3. fails to respect a commitment date it has identified or the terms of a work plan it has submitted to our Office.

Deemed Denial

Subsection 16(3) of the Privacy Act states that, if the head of a federal institution fails to give an individual access to his or her personal information within the time limits set out in the Act, the head of the institution is deemed to have refused to give access to it.

When we make a finding of “deemed denial” under the Act, we are confirming Parliament’s intent that endlessly delaying access to personal information is no different from refusing access outright. 

Such a finding also opens the door for the affected individual, or the Privacy Commissioner, to refer the matter to the Federal Court for review.

We are confident that our new approach will encourage federal institutions to give individuals more timely access to their personal information.