Airport employee demands access to personal information from airline
PIPEDA Case Summary #2002-60
[Principles 4.5 and 4.5.2, Schedule 1; sections 4(2)(b), and 8(3)]
An airport employee complained that an airline had refused her access to her personal information in the form of records relating to a complaint previously lodged against her by airline employees.
Summary of Investigation
Our complainant had herself been the subject of a complaint lodged with the airport authorities in late 1999 by several employees of the airline in question. These employees had sent a copy of their complaint to their own employer, the airline. In early 2000, the airport had officially responded to the airline's management on the matter of the complaint, and the airline employees in question had each received a copy of this response.
In mid-May 2001, our complainant sent the airline a formal request for access to all information holdings related to the complaint previously lodged against her. Still not having received a response from the airline in late August, she lodged her own complaint with the Commissioner's Office.
Through interviews and searches, the Office established that the airline no longer had any information on file regarding the complaint that its employees had lodged against our complainant. Of the employees themselves, only one had retained records relevant to that complaint, but was unwilling to release them. The airline took the position that in any case it had not created the records and did not have them in its control to release.
In late April 2002, at the Office's intervention, our complainant finally received a response to her original access request, to the effect that the airline was no longer holding any records relevant to the request.
Issued July 19, 2002
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because airlines are federal works, undertakings, or businesses as defined in the Act.
Application: Principle 4.5, Schedule 1, states in part that personal information must be retained only as long as necessary for the fulfilment of the purposes for which it was collected. Principle 4.5.2 states in part that personal information used to make a decision about an individual must be retained long enough to allow the individual access to the information after the decision has been made. Section 4(2)(b) stipulates that the Act does not apply to any individual in respect of personal information that the individual collects, uses, or discloses for personal or domestic purposes and does not collect, use, or disclose for any other purpose. Section 8(3) states that an organization shall respond to a request with due diligence and in any case not later than 30 days after receipt of the request.
The Commissioner determined that the airline had had no obligation to keep information concerning the complaint about the airport employee because it had not needed the information for any purpose of its own and had made no decision about that person on the basis of the information. He found therefore that the airline had been in compliance with Principle 4.5 and had not contravened Principle 4.5.2. He also found, with reference to section 4(2)(b), that the information still in the possession of the airline's employee was not subject to the Act.
Nevertheless, the Commissioner determined that the airline had failed to respond to the complainant's access request within the prescribed 30-day time limit. He found therefore that the airline had contravened section 8(3).
Noting that the complainant did eventually receive an appropriate response, the Commissioner concluded that the complaint was well-founded and resolved.
- Date modified: