Bank improperly invokes time extension provision in response to access request

PIPEDA Case Summary #2003-199

[Sections 8(3), 8(4) and 8(5); Principle 4.9]

Complaint

An individual made a formal, written access request to a bank seeking documents related to a mortgage dispute involving her, her ex-spouse, and the bank. Twenty-eight days later, the bank wrote to her, notifying her that, pursuant to section 8(4), it required 30 additional days to respond to her request. The complainant objected to this extension and filed a complaint with the Commissioner.

Summary of Investigation

To the complainant, this was another effort by the bank to delay providing her with information she had been seeking for some time. As the mortgage dispute had been the subject of an investigation by the bank's ombudsman, she thought all of her information could have been easily accessed from the ombudsman's office. The bank stated that since the complainant was not satisfied with the ombudsman's findings in her case, it assumed that she had not received the information she was seeking. The bank, therefore, did not contact the ombudsman's office.

Although the bank did not specify which part of section 8(4) it was relying on in its letter to the complainant, in its representations to the Commissioner the bank referred to sections 8(4)(a)(i) and (ii) to justify the extension. While it acknowledged that it would not have been impossible to have produced all of the items requested within the original 30-day timeframe, it maintained that to have done so would have unreasonably interfered with its activities since the request was extensive (20 items were requested) and the official responsible for handling the request was away for a total of 10 working days. In addition, the bank asserted that it needed time to consult with the branches involved in the dispute and its mortgage centre in order to compile and review the information.

Almost two months after the request was made, the complainant received documentation from the bank. Although she was of the view that information was missing, specifically a key document related to the mortgage dispute, the investigation confirmed that no such document existed.

Subsequent to the Office's review of the information held at one of the branches, a file was found containing information about the complainant that had not been previously provided to her. The bank agreed to immediately review this file and provide the complainant with the information to which she is entitled under the Personal Information Protection and Electronic Documents Act (the Act).

Commissioner's Findings

Issued August 1, 2003

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.9 states that, upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) stipulates that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(4) states that an organization may extend the time limit

1. for a maximum of thirty days if
   1. meeting the time limit would unreasonably interfere with the activities of the organization, or
   2. the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet; or
2. for the period that is necessary in order to be able to convert the personal information into an alternative format.

In either case, the organization shall, no later than thirty days after the date of the request, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and of their right to make a complaint to the Commissioner in respect of the extension. Section 8(5) establishes that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.

The key issue for the Commissioner was whether the extension was justified. He did not agree with the bank's reasons, noting that the consultations that were required were internal and that the officials of the two branches and mortgage centre would have likely been familiar with the case. He therefore believed that the information could have been gathered within the 30-day timeframe set out in the Act.

He also noted that in spite of the extension, the bank still overlooked a file containing more of the complainant's personal information. The Commissioner stressed the importance of organizations' conducting thorough and expeditious searches when processing access requests and retaining an exact copy of the documents that are processed and sent to complainants. Access to one's personal information is a key element of privacy legislation - a fact that should be reflected in the procedures used by organizations.

Since the Commissioner did not accept the bank's reasons for the extension under section 8(4), he found that it did not meet its obligation under section 8(3), was deemed under section 8(5) to have refused her request, and was thus in contravention of Principle 4.9 of Schedule 1.

The Commissioner therefore concluded that this complaint was well-founded.

Further Considerations

The Commissioner recommended that the bank provide the complainant with the remainder of the personal information to which she is entitled, as soon as possible, and to undertake improvements to its procedures for handling access requests. He also noted that, when citing exemption or extension provisions under the Act in response to access requests, an organization should be as specific and clear as possible.