The Office of the Privacy Commissioner has recently (24 January 2005) released a finding based on a complaint brought by a former employee who sought access to his personal information. The complainant was already suing his former employer related to his employment.

The case raises a number of interesting issues: you can only charge a token amount ($1500 is not a token amount) to provide access to personal information and discovery rights under concurrent litigation do not oust the right of access under PIPEDA:

Commissioner's Findings - PIPEDA Case Summary #285: Company refuses former employee's request for access - December 21, 2004 - Privacy Commissioner of Canada:

"Finally, the Assistant Commissioner commented on the two issues raised by the respondent during the investigation. With respect to the view that the complaint was an attempt to circumvent the disclosure and production rules under the Rules of Civil Procedure, the Assistant Commissioner noted that the scope of discovery is different from the scope of an access to personal information request under the Act. Discovery requires each party to a proceeding to disclose before trial all of the facts and information that it is aware of and that are relevant to the issues in the lawsuit. The Act grants a right of access to all personal information about an individual held by an organization, subject to certain exceptions, whether relevant or not. The Assistant Commissioner maintained that documents received through discovery cannot be considered sufficient to meet the requirements of an access request under the Act.

Regarding the company's concerns about providing minutes from board meetings to the complainant, the Assistant Commissioner reminded the organization that the Act provides for exceptions to the right of access to one's personal information, which are outlined in section 9, noting in particular the provision regarding confidential commercial information.

She recommended that the company examine its records and provide the complainant with access to all of his personal information collected, used or disclosed during the time period requested, subject to any exceptions.

The Assistant Commissioner noted that she remained skeptical that no single member of the board of directors took notes during the meetings when the decision to terminate the complainant's employment and his ensuing lawsuit were discussed. She recommended that the company confirm with all staff members and directors that no notes, e-mails or other material collected and retained contained the complainant's personal information. The Assistant Commissioner asked that the company report back to her to confirm what actions it had taken in response to the complainant's allegations."

Labels: information breaches, litigation, privacy