BreachOfPrivacy
Decisions/Federal (Canada)/Personal Information Protection and Electronic Documents Act/PIPEDA findings #2017-011: Financial institution originally misuses confidential commercial information exemption to withhold personal information
Office of the Privacy Commissioner of CanadaPersonal Information Protection and Electronic Documents ActPIPEDA findings #2017-011Well-founded & resolved
Flag of Canada

PIPEDA findings #2017-011: Financial institution originally misuses confidential commercial information exemption to withhold personal information

Organization: A financial institution
Decision: Mar 31, 2017Published: Mar 31, 2017

A complainant alleged that a financial institution refused to provide access to personal information related to a disputed credit card transaction. The institution initially claimed the information was confidential commercial information under PIPEDA. While the OPC found the institution's initial claim of exemption was unfounded, it later determined that the redacted information was not the complainant's personal information, but related to third parties. The OPC concluded the complaint was well-founded due to the delay and improper initial claim, but resolved as the complainant ultimately received access to his entitled personal information.

  • Whether the financial institution properly withheld personal information under the confidential commercial information exemption (PIPEDA s. 9(3)(b)).
  • Whether the financial institution responded to the access request within the time limits prescribed by PIPEDA.
  • Whether the withheld information constituted the complainant's personal information or third-party information.
  • Whether the complainant received appropriate access to personal information concerning a disputed credit card transaction.

Complaint well-founded and resolved — initial exemption claim unfounded but information not complainant's personal information

The institution improperly claimed the confidential commercial information exemption, causing a delay. However, the investigation ultimately found that the redacted information was not the complainant's personal information but related to third parties, to which the complainant was not entitled.

AI-generated summary for reference only. Always verify against the official decision ↗

Recommended action / remedy

The financial institution was required to provide the complainant with access to all of his personal information and to ensure future responsiveness and timeliness in handling access requests.

Statutory provisions cited
  • s. 9(3)(b) PIPEDA
  • s. 8(3) PIPEDA
  • s. 8(4) PIPEDA
  • s. 9(1) PIPEDA
  • Principle 4.9 PIPEDA

This is an informational summary of a privacy decision and not legal advice.