Employer sends third parties copies of response to employee's access requests
PIPEDA Case Summary #2001-20
[Principles 4.3 and 4.5, Schedule 1; and section 5(3)]
An employee of an airport authority complained that her employer had, without her consent, disclosed to three third parties her personal information in the form of copies of a letter of response to access requests she had made.
Summary of Investigation
The complainant had submitted requests under the Personal Information Protection and Electronic Documents Act for access to information held by her employer. The employer subsequently sent her a letter of response to the effect that the organization was refusing her requests. This letter also indicated that copies were being sent to three other persons-specifically, two union representatives and the coordinator of employee relations at the airport. The complainant had not sent copies of her access requests to these parties and had not explicitly consented to having copies of the response letter sent to them.
The union representatives had previously attended the meeting at which the issue of access to the complainant's personal information had first been raised. The employee relations coordinator had previously intervened in a harassment complaint filed by the same complainant and had in his possession certain related documents to which the complainant had requested access. On the grounds of these prior involvements, the employer argued that the complainant had implicitly consented to the disclosures. The complainant maintained that she had submitted the access requests personally on her own behalf, without union intervention.
Issued November 5, 2001
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to federal works, undertakings, or businesses. The Commissioner had jurisdiction in this case because airports are federal works, undertakings, or businesses, as defined in the Act.
Application: Principle 4.3, Schedule 1, states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.5 states that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.
Regarding Principle 4.3 and the disclosure to the union representatives, the Commissioner determined that there would have been implied consent for the employer to send response copies to those parties only if the complainant had indicated that she had sent them copies of her access requests. The complainant had the right to exercise her formal recourse without union intervention, and it was not necessary for the employer to inform the union of its response. The Commissioner found that no implied consent had existed as far as the union representatives were concerned. Furthermore, in consideration of section 5(3), he was satisfied that a reasonable person would have considered the disclosure to the union representatives to be unacceptable.
The Commissioner concluded therefore that this aspect of the complaint was well-founded.
Regarding Principle 4.5 and the employee relations coordinator, given the direct involvement of that party in the access request, the Commissioner determined that it had been appropriate for the employer to inform him of its decision to refuse the complainant access to the documents she had requested. Furthermore, in consideration of section 5(3Ü, the Commissioner was satisfied that a reasonable person would have considered the communication to the employee relations coordinator to be acceptable. He found that the employer was thus in compliance with Principle 4.5 as far as the employee relations coordinator was concerned.
He concluded therefore that this aspect of the complaint was not well-founded.
During the investigation, the Office of the Privacy Commissioner advised the airport authority in question that it is preferable not to send copies of responses to third parties, but rather to allow the individual requester to judge whether or not to share a response with others after receiving it. The Commissioner was pleased to note that the organization had followed this advice in dealing with subsequent access requests by the complainant.
- Date modified: