Individual denied access to personal information

PIPEDA Case Summary #2002-112

[Principle 4.9 of Schedule 1, and sections 8(3) 8(4) and 8(5)]

Complaint

An individual complained that his Internet service provider had denied him access to his personal information regarding his account.

Summary of Investigation

An individual requested specific records pertaining to his account. Twenty-five days later the company sought information from the complainant as to his identity without indicating it required an extension of time to respond to his request. The complainant provided the information, and the company released the documents he was seeking - 34 days after the complainant's request.

Commissioner's Findings

Issued December 19, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because an Internet service provider is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.9 of Schedule 1 states that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) establishes that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(4)specifies that an organization may extend the time limit and if so, it must inform the individual within 30 days of the date of the request. Section 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

As the company sent the complainant the information he had requested 34 days after it had received his request, which is four days beyond the time prescribed in the Act, the Commissioner found that it did not meet its obligation under sections 8(3) and 8(4) and thus was technically deemed to have refused his request contrary to Principle 4.9. However, the Commissioner was pleased to note that the company ultimately provided the complainant with the requested information and that the complainant was satisfied.

He therefore concluded that the complaint was well-founded and resolved.