Your Right to See and Know is Sometimes Limited by Another Person’s Rights

It is important to understand that the right to access is sometimes limited.  Most of the time, the organization must give you access to your personal information. However, sometimes the organization can choose to refuse access, and sometimes the organization is required by law to refuse access.
These situations are a bit different depending on whether PIPA or PIPEDA applies to the organization.
For example, under PIPA, an organization may refuse to give you access to your personal information for the following reasons:

  1. if the information is protected by solicitor-client privilege (for example, if it is part of a legal opinion or a court case);
  2. if it was collected for an investigation;
  3. if it would reveal confidential business information; or
  4. if it was collected by a mediator or arbitrator in specified circumstances.

And under PIPA an organization must refuse to give you access to your personal information:

  1. if there is a health or safety risk in giving you the information;
  2. if doing so would reveal another individual’s personal information; or
  3. if giving access would reveal the identity of someone who gave an opinion about you and the opinion-giver has not consented to his or her identity being disclosed (for example, this can cover situations involving an employee review or a personal reference).

Under PIPEDA, an organization may refuse to give access:

  1. if the information is protected by solicitor-client privilege (for example, if it is part of a legal opinion or a court case);
  2. if it would reveal confidential commercial information;
  3. if it could reasonably be expected to threaten the life or security of another individual;
  4. if the information was collected in the course of an investigation into a breach of an agreement or a law;
  5. if the information was generated in the course of a formal dispute resolution process.

Under PIPEDA, an organization must refuse to give access to personal information if doing so would likely reveal personal information about a third party.

In all cases, if possible, the organization must separate the information you cannot have from the remainder of your personal information, and give you the remainder. This is called ‘severing’ the information.

What the Organization Must Tell You if it Refuses to Give You Access

If access to all or part of the information is refused by an organization under PIPA, it must tell you the reasons for the refusal and the section of PIPA that applies, and the contact information of an employee of the organization who can answer questions about the refusal. It must also tell you that you have the right to ask the Office of the Information and Privacy Commissioner of BC or a review within 30 days of being notified of the refusal.

If the organization is under PIPEDA and refuses to give you access, it must tell you in writing the reasons for the refusal and must tell you about any recourse you may have, including your right to complain to the Privacy Commissioner of Canada. You have six months after a refusal to make a complaint to the Privacy Commissioner of Canada.

If the organization doesn’t answer your request at all, it is deemed by law to have refused to give access. This means that you have a right to seek a review from the appropriate Privacy Commissioner.

Generally, Privacy Commissioners will encourage you to try to resolve your complaint directly with the organization before they get involved.