Responding to Access Information Requests
Procedure
1. Introduction
Individuals Precise ͵͵ Inc. (“Precise”) interacts with have a right under the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”) to request access to the personal information Precise holds about them.
2. Right of access
2.1. The Access Principle
PIPEDA requires us to respond in specific ways when receiving an individual’s request for personal information:
a) Inform individual requesters if Precise has the personal information about them that they are asking for;
b) Explain how it is or has been used, and provide a list of any organizations to which it has been disclosed on request;
c) Be prepared to give individuals access to their personal information, at minimal or no cost, in a form that is generally understandable;
d) Respond to requests within 30 calendar days, unless specific limited circumstances apply;
e) Correct or amend any personal information that is shown to be factually inaccurate or incomplete, and, when appropriate, transmit the amended information to any parties to whom you may have sent the original information;
f) If Precise does not agree that the information was inaccurate or incomplete, retain a record of the unresolved challenge and, when appropriate, transmit the record to any third party to whom Precise may have disclosed the original information.
2.2. Exemptions
PIPEDA only allows organizations to deny access to personal information in certain circumstances. Specifically, an organization is required to give access to personal information unless:
a) Disclosure would reveal personal information about someone else. However, if the information that relates to the third party can be severed or blacked out, Precise is required to provide the information to the requester with such third party information stricken or removed.
a. This exemption does not apply if the third party consents to releasing this information or if the individual needs the information because somebody’s life, health or security is threatened.
b) The information is protected by solicitor-client privilege.
c) Disclosure of the information would reveal confidential commercial information. If possible, the organization should address this problem by striking or severing portions of the information, meaning Precise must give the requester access to the rest of their personal information.
d) Disclosure of the information could reasonably be expected to threaten the life or security of another individual. Again, if possible, address this problem by severing this information, Precise must give the requester access to the rest of their personal information.
e) The information was collected for purposes related to an investigation of a breach of an agreement or a contravention of the laws of Canada or a province, and it would be reasonable to expect that the individual’s knowledge of or consent for the collection would compromise the availability or accuracy of the information.
f) The information was generated during a formal dispute-resolution process.
g) The information was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act (commonly referred to as the whistleblower law), or in the course of an investigation into a disclosure under that Act.
2.3. Exceptional circumstances
There may be exceptional times when Precise is required to disclose personal information without an individual’s consent in order to comply with a subpoena, warrant or court order. Similarly, Precise may disclose personal information without consent to a government institution or an investigative body for a purpose such as national security, national defence or the deterrence of terrorism, aiding law enforcement, or in relation to a suspected money-laundering offence.
It is possible that an individual may request access to information related to a disclosure made in one of the above-mentioned scenarios. If Precise receives a request for such information, it must notify the institution to which it had previously disclosed the personal information. The institution would then have 30 days to respond.
Precise may not respond to the individual’s access request before either hearing back from the institution or until 30 days has passed since notified it; whichever occurs first.
If the institution objects to the release of the information to the individual based on permissible grounds, Precise must withhold it. Moreover, Precise may not reveal that it communicated with the institution or that it objected to the disclosure.
Precise must also immediately notify the Privacy Commissioner of Canada (the “Privacy Commissioner”) in writing about its refusal to release the information.
3. Responding to access requests
3.1. Getting started
a) A request has to be in writing. Precise may need to ask the individual for more information in order to verify his or her identity or to locate the information.
b) Some people may need help in preparing their request. Precise is required to help them if they ask and may ask them for further information to facilitate this process.
3.2. Analyze the request
After receiving the request, Precise shall:
a) Review and analyze the request to make sure to understand what is being sought.
b) Identify all sources and records that may hold the personal information that the individual is requesting.
c) Retrieve and review the identified records to confirm that they actually contain the personal information requested.
d) Photocopy the documents if they are on paper, and number them.
e) Access should be free or at minimal cost. If a fee is being contemplated, Precise will give the individual an estimate of the cost and make sure their agreement is received before going further.
3.3. Apply exemptions
a) Precise should identify any personal information withheld from disclosure.
b) If information that is exempt from access can be severed, it will be removed, and the requester will be given access to the rest of the requested information.
c) If any of the exemptions recognized in PIPEDA are applied, Precise must give the requester a written explanation of the decision, set out the reasons and inform the individual of his or her right to complain to the Privacy Commissioner.
d) If Precise decides not to give access to an individual’s personal information on the grounds set out in paragraph 2.2(e) of this policy, Precise must inform the individual of the reason and notify the Privacy Commissioner.
e) As outlined above, there may be exceptional circumstances in which Precise shall not provide an individual with any information about a past disclosure made about them for national security, national defence, deterrence of terrorism, law enforcement or in relation to a suspected money-laundering offence. In such cases, however, Precise must notify the Privacy Commissioner in writing and without delay of the refusal.
3.4. Provide access to the information
a) When Precise is ready to give the requester the information (including any necessary deletions or redactions), clear and readable photocopy the documents that are to be disclosed will be prepared, or electronic documents in CSV format.
b) In cases where a large number of documents are involved, Precise may consider inviting the requester to simply look at the documents at Precise’s premises.
c) To accommodate a disability, some people may ask to receive their personal information in alternate formats, such as audio files for individuals with visual impairment. Precise should fulfill this request if the information already exists in the alternate format, or if conversion to that format is reasonable and necessary for an individual to exercise rights under PIPEDA.
d) Upon request, Precise should also explain how the personal information was used. If it was shared with third parties, provide a list of them. If that is not feasible, indicate the organizations with which it may have been shared.
e) If information in a document is retained in a format different from the one in which it was initially collected, then it is permissible simply to provide access in this alternative format.
f) Precise will include the name and contact information of a Precise employee who can respond to any questions the individual may have.
g) Precise will keep a copy of any documents as they were sent, subject to appropriate retention policies.
h) Precise will also need to retain the original personal information that was the subject of the request for as long as necessary for individuals to exercise their rights under PIPEDA.
i) Precise should inform individuals that they have a right to complain to the Privacy Commissioner about issues related to their request.
3.5. Time limit extensions
- Precise is obliged to respond to the request for personal information within 30 calendar days of receipt of a legitimate request. PIPEDA only allows for an extension of the 30-day time limit under these specific circumstances:
- If responding to the access request would interfere to an unreasonable degree with Precise’s activities;
- If responding to the request would require Precise to undertake consultations that would make it impracticable to meet the 30-day deadline; or
- If an individual requires the information in an alternate format and it would take significant amounts of time to convert it.
In such instances, Precise may take up to 30 additional days or the period of time necessary to convert the personal information into an alternative format to respond.
Precise must contact the individual within the first 30 days to explain the reason for the delay, and advise the individual of their right to complain to the Privacy Commissioner about the delay.
Updated January 23, 2024