Company exceeds time limits in responding to request for access to personal information
PIPEDA Case Summary #2003-195
[Principle 4.9; sections 8(3) and 8(5)]
Complaint
An individual complained that his former employer, a railway company, refused to provide him with access to his personal information.
Summary of Investigation
The complainant made his access request via e-mail. Fifteen days later, he was informed that the official to whom he made the request did not have his file. It was only after he complained to the Commissioner's Office, several months later, that the company provided him with the opportunity to view his information.
The company acknowledged that it had not responded to the request in accordance with its obligations under the Personal Information Protection and Electronic Documents Act (the Act). It stated that initially there was some confusion as to whether the primary human resources office where most personnel files are kept had the entire file or whether the office in the region where the complainant worked had additional information. After some initial effort to locate the complete file and make arrangements for the complainant to view it, company officials did not pursue the matter further until after the complainant contacted the Commissioner's Office.
Approximately two months after the complaint was filed, the company contacted the complainant to inform him that he could view the file but could not copy the contents. However, at the intervention of the Commissioner's Office, the company agreed to allow the complainant to make a copy.
The company has since taken steps to improve its response to access to information requests to ensure that it meets its obligations under the Act.
Commissioner's Findings
Issued July 23, 2003
Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a railway company is a federal work, undertaking, or business as defined in the Act.
Application: Principle 4.9 states that, upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) stipulates that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) establishes that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.
The company did not dispute that it failed to provide the complainant with his personal information within the 30-day time limit set out in section 8(3) of the Act. The Commissioner therefore found that the railway did not meet its obligation under section 8(3), was thus deemed under section 8(5) to have refused the request, and was in contravention of Principle 4.9 of Schedule 1. Nevertheless, the Commissioner was pleased that the company eventually provided the complainant with the information to which he was entitled.
The Commissioner concluded that the complaint was well-founded and resolved.
- Date modified: