Condita Research
← Back to catalogue/Federal (Canada)PIPEDA Case Summary #2016-007
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded & resolved

PIPEDA Case Summary #2016-007: An organization's privacy policy and procedures must be implemented effectively

Organization: A collection agencyComplainant: Anonymous applicant
BookmarkView Governing Law
Plain-language brief

An individual complained that a collection agency repeatedly refused to provide access to their personal information, despite multiple written requests. The individual was disputing a debt the agency was attempting to collect and sought information related to the alleged debt account. The OPC found that the agency failed to respond to several of the individual's access requests, contravening PIPEDA subsections 8(3) and 8(5), and Principle 4.9. Although the agency eventually provided the information during the investigation, the OPC noted that the agency had not followed its own privacy procedures for handling access requests. The agency committed to revising its procedures and providing refresher training to its employees. The complaint was deemed well-founded and resolved.

Key issues
  1. 1Whether the organization refused to provide access to personal information
  2. 2Whether the organization responded to access requests within the required timeframe
  3. 3Whether the organization followed its own privacy policies and procedures for access requests
  4. 4Whether the organization maintained records of access request processing
Outcome breakdownFavours: Applicant / complainant
  • Access to personal information: Agency failed to respond to requests
  • PIPEDA compliance: Agency contravened subsections 8(3) and 8(5) and Principle 4.9
  • Internal procedures: Agency failed to follow own privacy procedures
  • Remedial action: Agency committed to revising procedures and training
  • Complaint outcome: Complaint well-founded and resolved
Outcome

Complaint well-founded and resolved

Reasoning

The OPC found that the agency failed to respond to multiple written access requests, contravening PIPEDA. However, the agency ultimately provided the information during the investigation and committed to improving its internal processes.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The agency was deemed to have ultimately provided access to the personal information. The agency committed to revising its procedures and offering refresher training to its employees and management on access requests. The OPC also suggested the agency keep clear written records of how and when it complies with access requests.

Statutes considered
  • subsection 8(1) PIPEDA
  • subsection 8(3) PIPEDA
  • Principle 4.9 PIPEDA
  • subsection 8(5) PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro