PIPEDA Case Summary #2016-008: Investigation into a telecommunications company’s response to an individual’s request for access to information about disclosures of her personal information to other parties
An individual complained that a telecommunications company (telco) provided an incomplete response to her access request for information about disclosures of her personal information to other parties, including law enforcement. The telco initially responded by stating it was in compliance with specific PIPEDA subsections, without confirming or denying disclosures. The OPC found that the telco's response did not meet its obligation under Principle 4.9 of PIPEDA, which requires organizations to inform individuals of the existence, use, and disclosure of their personal information. The OPC clarified that an organization must provide a clear 'yes' or 'no' answer regarding disclosures, unless a government institution objects to such disclosure under PIPEDA s.9(2.4). Following the OPC's recommendation, the telco provided a complete response to the complainant and updated its policy for handling future access requests. The complaint was deemed well-founded and resolved.
- 1Whether the telco's initial response to an access request for disclosure information met its obligations under Principle 4.9 of PIPEDA
- 2Whether the telco's practice of stating compliance with PIPEDA s.9(2.1)-(2.4) was sufficient for access requests
- 3Whether the telco had an obligation to provide a 'yes' or 'no' answer regarding disclosures to all third parties, including those not covered by PIPEDA s.9(2.1)-(2.4)
- 4How an organization should respond to an access request for disclosure information when a government institution objects under PIPEDA s.9(2.4)
- Completeness of response: Initial response incomplete
- Obligation to confirm disclosure: Organization must provide clear 'yes' or 'no'
- Policy update: Telco updated its policy
- Complaint outcome: Complaint well-founded and resolved
Complaint well-founded and resolved
The telco's initial response was insufficient under Principle 4.9 as it did not inform the complainant whether her personal information had been disclosed. The matter was resolved after the telco provided a complete response and updated its policies as recommended by the OPC.
The telco was recommended to provide a direct response to the complainant's access request regarding disclosures and to cease its practice of sending the initial, non-informative reply, ensuring its responses align with OPC guidance.
- Principle 4.9 PIPEDA
- Principle 4.9.1 PIPEDA
- s.7(3)(c) PIPEDA
- s.7(3)(c.1) PIPEDA
- s.7(3)(c.1)(i) PIPEDA
- s.7(3)(c.1)(ii) PIPEDA
- s.7(3)(c.2) PIPEDA
- s.7(3)(d) PIPEDA
- s.9(2.1) PIPEDA
- s.9(2.2) PIPEDA
- s.9(2.3) PIPEDA
- s.9(2.4) PIPEDA
- s.9(2.4)(c) PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro