Findings under the Personal Information Protection and Electronic Documents Act (PIPEDA)
PIPEDA Case Summary #2003-148
Air traveller offended by airline's information requirements for baggage claim
[Principles 4.2, 4.2.3, 4.3, 4.3.2, and 4.3.3, Schedule 1; and section 5(3)]
A passenger complained that an airline had required her to supply too much personal information as a condition for processing her claim of missing baggage. Specifically, she objected to the requirement to fill in her Social Insurance Number (SIN), her date of birth, and her occupation on the airline's baggage claim form.
Summary of Investigation
When the complainant reported missing baggage at the airline's claims desk, she was given a baggage claim form and told to complete and submit it after five days if she still had not received her baggage. Though offended at being asked for her SIN, birthdate, and occupation in particular, the complainant did eventually complete and submit the form so that the airline would pursue the matter.
The form requested many items of personal information, none designated as optional, and identified two purposes for the information collection - tracing baggage and serving as the basis of a claim. The form did not specify that the complainant's personal information it collected would be filed in a tracing system used by air transport organizations worldwide and would thus be accessible to other parties. Nor did it specify that serving "as the basis for a claim" actually meant not only processing a claim, but also investigating the credibility of the claimant.
The tracing system included an investigation module whereby the airline, following an unsuccessful trace, could crosscheck for prior claims and any suspicious informational inconsistencies possibly indicating fraudulent intent on a claimant's part. The airline acknowledged that most of the personal information it collected via its form was used as much for the purpose of claims verification as for the purpose of tracing baggage. The airline maintained that not all the information on its form was mandatory, and that claimants had discretion to decline to provide an item if they did not feel comfortable in doing so. However, the form itself did not indicate that any of the information it requested was optional, nor did it appear that the airline made a practice of informing claimants that they had any discretion in the matter.
In discussions with the airline, the Commissioner's Office took the following position: (1) it is not appropriate for an organization to require the provision of a SIN as an identifier; (2) in view of its unreliability and prejudicial nature, an individual's occupation is not an appropriate item to request as a means of verifying a claim nor is "company name"; (3) date of birth and several of the other items of personal information requested on the claims form should be designated as optional; (4) the purpose statement on the form should be revised so as to specify that collected personal information is recorded in a tracing system available to other users, and clarify that claims verification is one of the purposes.
The airline agreed to revise its purpose statement as proposed, to remove SIN from the form, and to designate date of birth, passport number, and passport name as optional. The airline was reluctant to make further concessions.
Issued April 9, 2003
Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because airlines are federal works, undertakings, or businesses as defined in the Act.
Application: Principle 4.2 states that the purposes for which personal information is collected must be identified by the organization at or before the time the information is collected. Principle 4.2.3 states that the identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected; depending upon the way in which the information is collected, this can be done orally or in writing. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2, emphasizing the requirement for the individual's knowledge, states that organizations must make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used; to make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. Principle 4.3.3 states that an organization must not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified and legitimate purposes. Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.
Regarding Principles 4.2 and 4.3.2, the Commissioner determined that the airline had identified two purposes for the collection, but had not in either case stated the purpose in a manner reasonably conducive to the complainant's understanding of how the information would actually be used or disclosed. The airline should have clarified that tracing baggage would involve putting personal information into the tracing system and creating a potential for disclosure to other users of that system. The airline should also have clarified that serving as the basis of a claim meant verifying the claim as well as processing it. In sum, he determined that the vaguely formulated purpose statement on the form had not in itself constituted a reasonable effort on the company's part to advise the complainant of the purposes for which his personal information was to be used or disclosed. He found therefore that the airline was in contravention of Principles 4.3.2 and 4.2.
Regarding Principle 4.2.3, the Commissioner determined that the counter agent who had initially taken personal information from the complainant had made no effort to explain to her what was to be done with the information. Although the agent might well have assumed the complainant's understanding that it would be used to trace her baggage, she should have at least informed her of the means by which the information was to be recorded and by which the tracing would be done - that is, the tracing system. The Commissioner found therefore that the airline was in contravention of Principle 4.2.3.
Regarding Principle 4.3, the Commissioner noted that the individual's knowledge is required as a basis for consent. In order for the airline company to have inferred the complainant's consent for baggage tracing by means of the tracing system or for verifying her claim, it should first have let her know that those were the specific reasons why it was collecting her personal information. The Commissioner determined that the airline, having failed to attend adequately to the knowledge of purposes in accordance with Principles 4.2, 4.2.3, and 4.3.2, had had no valid basis for consent. He found therefore that the airline was in contravention of Principle 4.3.
Regarding Principle 4.3.3, the Commissioner determined that the airline had insisted on the completion of the form as a condition for pursuing the matter of the missing baggage and had not indicated that any item of information on the form was optional. He reiterated that the purposes for which the airline had collected the personal information had failed to meet the identification standards prescribed under Principles 4.2, 4.2.3, and 4.3.2. He pointed out that, even if explicitly specified, verifying an individual's identity is never a legitimate purpose for requiring the provision of the SIN. He was also of the view that occupation and company name are likewise unacceptable as a means of verifying a claim. In sum, he determined that the airline's collection of SIN, birthdate, occupation, and company name was beyond that required to fulfil explicitly specified and legitimate purposes. Moreover, he was satisfied that a reasonable person would not have considered the collection of those items appropriate in the circumstances. The Commissioner found therefore that the airline was in contravention of Principle 4.3.3 and section 5(3).
He concluded that the complaint was well-founded.
The Commissioner recommended that the airline:
(1) follow through with the undertakings previously agreed which were: to revise the purpose statement on its Baggage Declaration Form as proposed; to remove "social insurance number" from among the items requested on the form; to designate "date of birth", "passport number", and "name on passport" as optional; and to further designate that the request for "name on passport" applies only in the case where the name differs from any previously supplied;
(2) designate "business address", "business telephone", "e-mail", and "frequent flyer ID" as optional;
(3) remove "occupation" and "company name" from the form;
(4) group all optional items on the form under one heading so that passengers may choose to complete some, all or none of the items;
(5) specify, at the items "prior address" and "prior telephone number", that these requests are made solely for the purpose of verifying the claim; and
(6) instruct its baggage claims agents to explain to the individual the use to be made of personal information collected at the time missing baggage is first reported; to specify that the information is to be filed in the tracing system and made available to other users of the system; and to limit initial information requests to those items that are justifiable in terms of the strict purpose for the initial collection - that is, tracing baggage reported as missing.