On December 13, 2012, the Office of the Privacy Commissioner of Canada released Report of Findings #2012-004 (August 22, 2012) relating to the unauthorized disclosure to an imposter of a cell phone customer’s account information. In addition, the Report of Findings addresses the scope of an individual’s access rights under the Personal Information Protection and Electronic Documents Act (PIPEDA). It is this aspect of the decision that is the subject of this post.
PIPEDA Access Rights
Principle 4.9 of Schedule 1 to PIPEDA provides that “an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information”. Subsection 8(1) of PIPEDA requires that a request for access be made in writing. Pursuant to subsection 8(3) of PIPEDA, an organization must respond to the request within 30 days subject to certain exceptions. Notwithstanding an individual’s access right under Principle 4.9, an organization is prohibited under section 9(1) of PIPEDA from providing an individual access if it would reveal information about a third party. If the information about the third party can be severed, the organization should follow that procedure in providing access.
No Obligation to Provide Access in a Particular Medium
In Report of Findings #2012-004, the complainant sought a copy of the recording between the imposter and the customer service representative. The organization offered to permit the complainant an opportunity to listen to the recording at the company’s premises. The organization also provided a transcript of the call and deleted the customer service representative’s name. The complainant did not take up the offer to listen to the recording and complained to the OPC regarding the completeness of the transcript.
The OPC concluded as follows:
 Regarding the redactions that the company had made from the call transcript that it provided the complainant, we have reviewed those redactions and find them to be in compliance with subsection 9(1) of the Act, which requires an organization to sever personal information about a third party before allowing an individual access to their own personal information. The information redacted from the transcript (i.e., the CSR’s name) belongs to a third party.
 As for the issue raised by the complainant that he was not provided with an audio recording of the conversation which took place between the imposter and the CSR, the Act provides individuals with the right to access their personal information. The Act does not, however, require an organization to provide access in a particular medium. Only under section 10 of the Act must an organization give access to personal information in an “alternative format” to an individual with a sensory disability and who requests that their personal information be transmitted in the alternative format. The complainant’s case does not fall within these circumstances. Rather, the company did provide the complainant with the call transcript containing the personal information, and to which he was entitled under the Act. It is, therefore, not required to further provide him with a copy of the recording.
It should be noted that the OPC did not state that a transcript would always suffice. The organization provided the complainant with the opportunity to listen to the recording. A recording of a voice contains more information about the person than what would appear on a transcript. The OPC might conclude that an individual may have a right to listen to the audio recording. Factors that the OPC might consider to be relevant may include whether there is third party information in the recording that cannot be severed without significant and disproportionate cost.