Accessing your personal information

Overview

Under the Personal Information Protection Act (PIPA), you have a right to access your personal information held by an organization and to ask an organization to correct it.

How to request your information

To request your own personal information under PIPA, you must make the request in writing. Many organizations have a Privacy Officer who will receive requests, but they may have a different title depending on the size and needs of the organization. Organizations must also make every reasonable effort to assist someone requesting their information, so if it is unclear, they should tell you where you must send your request.

Organizations can charge fees for your personal information under PIPA, but not to correct your information and not if you request personal employee information. Fees must be reasonable and provided in accordance with the regulations.

Information that may be withheld

When requesting your own personal information, there is some information that organizations can refuse to provide, such as information collected for a legal proceeding or confidential commercial information.

Organizations must never provide:

information that could threaten the life or security of another individual
information that would reveal personal information about another individual
information that would reveal the identity of someone who provided an opinion about another individual in confidence, when that person does not consent to revealing their identity.

If you are looking for information held by a public body, such as a government department or a municipality, please see the Freedom of Information and Protection of Privacy Act (the FOIP Act) website.

Requesting corrections

To request correction of your own information held by an organization, you must make the request in writing.

When a request to correct an identified error or omission in personal information is received by an organization, they must:

correct it as soon as reasonably possible, and
notify any other organization(s) to which they may have previously disclosed it and that organization must also correct it

When a request does not result in correction, for example a professional or expert opinion, the organization must annotate the file to show the request for correction and that it was not made.

Making a complaint

If the organization refuses to provide you with your information, does not respond to you within 45 days unless they appropriately extend the time, or you feel the organization does not otherwise follow PIPA properly, you may make a complaint to the Office of the Information and Privacy Commissioner (OIPC).