Airline relies on access exemption to refuse traveler’s access to their personal information

PIPEDA Case Summary #2017-009

November 02, 2017

Complaint under the Personal Information Protection and Electronic Documents Act (the Act)

1. The complainant alleged that an airline (the respondent) did not provide complete access to his personal information. Specifically, the complainant alleged that the respondent did not provide him access to all documents, notes and correspondences in its direct or indirect control relating to an incident that occurred in 2015.

Summary of Investigation

The Incident

2. In 2015, the complainant was denied transportation on an airline flight.
3. Specifically, on the day of departure, officials responsible for screening passengers determined that the complainant was lacking appropriate documentation, and consequently, advised the respondent to prohibit the complainant from boarding the aircraft.
4. A couple months later, the complainant received a letter from the respondent confirming that the airline tickets would not be reimbursed as having the appropriate travel documentation was the responsibility of the passenger. Specifically, the respondent stated that “officials present at the airport for the purpose of screening passengers determined that [the complainant] was apparently lacking appropriate documentation, and consequently advised the airline to deny [the complainant] boarding.”
5. As a result, the respondent advised that it must “strongly consider this expert advice failing which it risks incurring liability for improperly documented arriving passengers.”

Access Request

6. Shortly after, the complainant submitted an access request to the respondent for his:
   1. complete Passenger Name Record (PNR) and/or PNR history; and
   2. documents and/or notes and/or correspondence internally and/or with third parties relating to the airline denying him transportation.
7. Three days later, the respondent acknowledged receipt of the request and advised a response would be provided within the next 30 days.
8. Eleven days later, the respondent provided the complainant with a copy of all records under the airline’s booking reference number including an interception report. However, the complainant believed the information received to be incomplete.
9. The complainant submitted a complaint to the Office of the Privacy Commissioner (the Office) regarding the respondent’s refusal to respond to his access request, specifically pertaining to the access request related to all documents exchanged with third parties on the day of the incident.

The Airline’s Representations

10. In response to a list of questions, our Office received several submissions from the respondent detailing how it had responded to the access request and the exemptions under the Act that it believed permitted it to refuse the provision of any further information to the complainant.
11. In particular, while the respondent confirmed it had provided the complainant access to details relating to the incident (the respondent’s interception reports), it stated that it would not be able to provide any documents, notes and correspondences internally and/or with third parties relating to the complainant being denied transportation due to paragraphs 7(1)(b) and 7(3)(c.1)(ii) of the Act (see relevant sections below).

(i) 7(1)(b) Collection without knowledge or consent

12. During the course of this investigation, the respondent notified the complainant it would not be providing him “a copy of the documents, notes or correspondence exchanged with third parties as it was collected to investigate a breach of agreement and/or contravention of the laws of Canada as described in [paragraph] 7(1)(b) of [the Act]. As per [paragraph] 9(3)(c.1) of [the Act], the [respondent] is not providing access to these records and, as per [paragraph] 9(5) of [the Act], the [respondent] has duly notified the Privacy Commissioner of Canada.” Our Office received a copy of this letter.
13. On the same day, the respondent notified the Commissioner under subsection 9(5) of the Act that it would not be providing the complainant with “a copy of the documents, notes or correspondence exchanged with third parties…Such correspondence was exchanged with the [government institution] and collected to investigate a breach of agreement and/or contravention of the laws of Canada as described in [paragraph 7(1)(b) of the Personal Information Protection and Electronic Documents Act (PIPEDA).” [name withheld]
14. Specifically, when asked to clarify how the respondent satisfied itself that the collection of the complainant’s personal information was reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province, it responded by stating that the information was collected in order to assess the travel status of the complainant.
15. On the day of the incident, officials determined that the complainant lacked appropriate documentation required for entry into the country. As a result, information was collected in order to investigate potential non-compliance to the Immigration and Refugee Protection Act and a recommendation by the government institution was provided to the respondent to disallow boarding of the complainant.

(ii) 7(3)(c.1)(ii) Disclosure without knowledge or consent

16. The respondent further notified the Commissioner in writing that it disclosed information to the government institution “under [subparagraph] 7(3)(c.1)(ii) in order to verify the travel status of the applicant.” Pursuant to subparagraph 9(2.1)(a)(i) of [the Act], the respondent asked the government institution if it could release the requested information, however, “[the government institution] refused to allow the release of such information.” As a result, the respondent did not provide the requested information to the complainant “pursuant to [paragraphs] 9(2.4)(a) and (b)”. [name withheld]

Application

17. In analyzing the facts, we applied the following provisions of the Act: paragraph 7(1)(b), subparagraphs 7(3)(c.1)(ii), 9(2.1)(a)(i), 9(2.4)(a), 9(2.4)(b), 9(2.4)(c)(i), 9(3)(c.1), subsection 9(5), as well as principles 4.3 and 4.9 of Schedule 1.
18. Principle 4.3 of Schedule 1 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
19. Principle 4.9 of Schedule 1 states, in part, that upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information.
20. Paragraph 7(1)(b) of the Act states that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.
21. Paragraph 9(3)(c.1) of the Act states that an organization is not required to give access to personal information only if the information was collected under paragraph 7(1)(b).
22. Subparagraph 7(3)(c.1)(ii) of the Act states that an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law.
23. Subparagraph 9(2.1)(a)(i) of the Act states that an organization shall comply with subsection (2.2) if an individual requests that the organization inform the individual about any disclosure of information to a government institution or a part of a government institution under paragraph 7(3)(c), subparagraph 7(c.1)(i) or (ii) or paragraph 7(3)(c.2) or (d).
24. Paragraph 9(2.4)(a) of the Act states that if an organization is notified under subsection (2.3) that the institution or part objects to the organization complying with the request, the organization shall refuse the request to the extent that it related to paragraph (2.1)(a) or to information referred to in subparagraph (2.1)(a)(ii).
25. Paragraph 9(2.4)(b) of the Act states that if an organization is notified under subsection (2.3) that the institution or part objects to the organization complying with the request, the organization shall notify the Commissioner, in writing and without delay, of the refusal.
26. Subparagraph 9(2.4)(c)(i) of the Act states that if an organization is notified under subsection (2.3) that the institution or part objects to the organization complying with the request, the organization shall not disclose to the individual any information that the organization has relating to a disclosure to a government institution or part of a government institution under paragraph 7(3)(c), subparagraph 7(3)(c.1)(i) or (ii) or paragraph 7(3)(c.2) or (d) or to a request made by a government institution under either of those subparagraphs.
27. Subsection 9(5) of the Act states that if an organization decides not to give access to personal information in the circumstances set out in paragraph (3)(c.1), the organization shall, in writing, so notify the Commissioner, and shall include in the notification any information that the Commissioner may specify.

Findings

Collection without knowledge or consent

28. At issue is whether the complainant’s consent was required for the respondent to collect his personal information. In general, Principle 4.3 requires the individual’s consent for the collection of personal information unless one of the Act’s exemptions to consent applies.
29. It is our view that, given the circumstances, the exemption from paragraph 7(1)(b) applied in this case and therefore the complainant’s consent was not required for the collection.
30. The evidence we received indicates that the respondent collected personal information from the government institution. Due to the lack of appropriate documentation to the country, the government institution had determined there was a possible contravention of the laws of Canada. Specifically, the information was collected in order to assess the travel status of the complainant, specifically, in order to investigate a non-compliance with the Immigration and Refugee Protection Act.
31. Furthermore, because the complainant’s personal information was collected in order to assess the complainant’s travel status, our Office finds it reasonable to expect that if the complainant had known the purpose for which his personal information was to be collected, the true exchange of information between the complainant and the government institution could have been compromised. Ultimately, as an international airline organization, the respondent had a responsibility to ensure the accuracy of all travel information and documents.
32. Therefore, in accordance with the exemption to consent provision of paragraph 7(1)(b), it follows that the respondent could collect the personal information of the complainant without his knowledge and consent, which would normally be required under Principle 4.3.

Disclosure without knowledge or consent

33. At issue is whether there was a disclosure of the complainant’s personal information. In this case, the respondent disclosed the complainant’s personal information, specifically his identification and passport details, to the government institution. The purpose of this disclosure was to assist the government institution in verifying the complainant’s travel status.
34. Our Office finds that the respondent disclosed the complainant’s personal information within the exemption to consent parameters of subparagraph 7(3)(c.1)(ii). Specifically, the respondent disclosed the complainant’s personal information to a government institution that was investigating and gathering intelligence for the purpose of enforcing the Immigration and Refugee Protection Act.

The Scheme

35. Although Principle 4.9 provides individuals with a right of access to their personal information and a right to be informed of the existence, use and disclosure of the individual’s personal information, section 9 sets out a number of mandatory and discretionary exceptions to this right.
36. In particular, subsections 9(2.1) to 9(2.4) set out a scheme that organizations must respect when individuals seek information regarding disclosures of information made under certain paragraphs and subparagraphs, including subparagraph 7(3)(c.1)(ii). Specifically, the exception to the general rule of providing access pursuant to Principle 4.9 is set out under subsection 9(2.4).
37. The purpose of the scheme under subsections 9(2.1) to 9(2.4) is to protect the integrity of lawful investigations. Accordingly, where an individual seeks either: �(a) to be informed about a disclosure to which these provisions apply or the existence of any information that the organization has relating to such a disclosure, or (b) access to such information itself, then the organization has an obligation to follow the process set out under subsections 9(2.2). This provision requires the organization, where it has made a disclosure to a government institution or a part of it, to ask the institution whether it objects to the disclosure of the information sought on certain grounds.^{Footnote 1}
38. Based on the wording of subsection 9(2.4), it is only in the event that the relevant government institution objects, that the organization becomes subject to the obligations under subsection 9(2.4), which include refusing the request, informing our Office, and not disclosing any of the information specified under paragraph 9(2.4)(c).^{Footnote 2}
39. In light of the above, our Office finds the respondent was limited in the manner it could respond to the complainant’s request for information, in accordance with subsection 9(2.4). Specifically, under paragraph 9(2.4)(c), all the information the respondent had, namely, the complainant’s personal information, was related to the disclosure to the government institution, which it was prevented from disclosing pursuant to subsection 9(2.4)(a).

Conclusion

40. Accordingly, our Office concludes that both the collection and disclosure complaints are not well-founded.