Personal Information Protection Act - Office of the Information and ...

A G u i d e f o r B u s i n e s s e s a n d O r g a n i z a t i o n s o n t h e P e r s o n a l I n f o r m a t i o n P r o t e c t i o n A c t
How do you respond to a request for personal information?
An organization must make every reasonable effort to help applicants (duty to assist). Your
response to an applicant must be open, complete and accurate (section 27). If the applicant
asks, and if it is reasonable to do so, you must explain any term, code or abbreviation used in
the record.
You must make a record of an applicant’s personal information if the information is in electronic
format and you can make the requested record using your normal computer equipment and
programs, and if this would not unreasonably interfere with your operations (section 27(2)). For
example, if you have a customer database and there is a report format for individual customers,
or if you can print a screen view of the customer’s personal information, then you must provide
this information on request.
You can provide a copy of a record instead of allowing an individual to examine a record if:
▲ the records may be damaged, for example, if they are fragile historical documents,
▲ other information would be disclosed that is not permitted by the Act, such as personal
information of another individual, or
▲ allowing inspection would unreasonably interfere with the operations of the organization,
for example, an employee would have to supervise the inspection of documents for a
significant amount of time while an applicant read them.
You must respond within 45 days of getting the request (section 28). The Act allows you to
take an extra 30 days to respond if:
▲ the request does not give enough information to allow you to find the personal information
or the record requested;
▲ a large amount of personal information is requested or has to be searched;
▲ completing the request in 45 days would unreasonably interfere with the operations of the
organization; or
▲ you must consult with another organization or public body to decide if access should be given.
You may also ask the Information and Privacy Commissioner to authorize a longer period to
respond (section 31(1)).
If you take extra time, you must tell the applicant:
▲ why you are taking more time,
▲ when you will respond to the request, and
▲ that he or she may make a complaint to the Commissioner about the organization taking
more time to respond (section 31(2)).
If you do not respond to the applicant in the required time, an applicant may complain to the
Information and Privacy Commissioner that your organization has refused access.
40
Service Alberta and the Office of the Information and Privacy Commissioner