PIPEDA Case Summary #2016-007: An organization's privacy policy and procedures must be implemented effectively
An individual complained that a collection agency refused to provide access to their personal information, despite multiple written requests. The agency failed to respond to several of these requests within the timeframes required by PIPEDA. Although the agency eventually sent the information, and the individual refused to sign for it, the agency was deemed to have provided access. The agency acknowledged it did not follow its own procedures for handling access requests and committed to revising them and providing refresher training.
- Timeliness of response to access requests
- Failure to follow internal procedures for handling access requests
- Adequacy of providing access to personal information
Complaint well-founded and resolved
The agency failed to respond to multiple access requests in a timely manner, contravening PIPEDA. However, the agency ultimately provided the information and committed to improving its procedures, leading to the complaint being resolved.
AI-generated summary for reference only. Always verify against the official decision ↗
The agency committed to revising its procedures for handling access requests and providing refresher training to employees and management.
- s. 8(1) PIPEDA
- s. 8(3) PIPEDA
- Principle 4.9 PIPEDA
- s. 8(5) PIPEDA
This summary is informational only and not legal advice.