The British Columbia Information and Privacy Commissioner (the “Commissioner”) recently ordered Compass Group Canada Ltd., a food, cleaning and maintenance service company (“Compass”), to disclose all records related to the job applications of a group of rejected applicants.
This decision provides insight into the disclosure obligations of private organizations. Organizations cannot refuse to disclose records containing personal information on the basis that they contain confidential or personal information protected by the Personal Information Protection Act (“PIPA”) if the offending portions of the documents can be redacted.
PIPA governs how private organizations handle personal information and creates rules regarding its collection, use, and disclosure. Section 23(1)(a) of PIPA gives individuals the right to access their personal information that is under the control of an organization. Compass Group Canada Ltd., 2018 BCIPC 06, is a decision of the Commissioner dealing with a request for disclosure under this section.
The applicants had applied for employment with Compass. When they were not hired, the applicants requested that Compass disclose their job application records. Compass provided some records, but withheld others. After mediation failed, 11 of the 52 applicants asked the Privacy Commissioner to conduct an inquiry.
The Commissioner ruled that Compass must disclose all of the requested documents with certain portions redacted to protect the privacy of other individuals.
The Commissioner’s Decision
The Commissioner rejected Compass’ argument that it should be authorized to disregard the disclosure requests because they were frivolous or vexatious. The Commissioner pointed out that Compass had not raised this issue previously, and that by the time of the inquiry, Compass had already responded to the requests (by refusing to disclose), and thus had nothing to gain. The Commissioner also rejected Compass’ argument that it should not have to disclose the records because it would be “frivolous” to duplicate information that the applicants had themselves provided to Compass during the interview process.
Compass’ key argument was that the records, which consisted of job interview forms containing template questions and “tick” boxes; reference forms; and one-word handwritten notations regarding hiring decisions, could not be disclosed, or were not required to be disclosed, because they fell under the following exceptions to disclosure:
- confidential commercial information that could harm Compass’ competitive position (the exception in s. 23(3)(b) of PIPA);
- personal information about another individual (the exception in s. 23(4)(c)); and
- the identity of an individual who provided personal information about the applicants and who does not consent to disclosure of his or her identity (the exception in s. 23(4)(d)).
The Commissioner held that the records did not contain confidential commercial information that could harm Compass’ competitive position. Contrary to Compass’ argument that the records reflected its “staffing and recruitment strategy”, there was nothing unique about the format or content of the interview questionnaire, the reference check forms, or the notations regarding the hiring decisions.
The Commissioner did agree with Compass that the records revealed certain personal information of other individuals (interviewers’ and referees’ names and hiring recommendations) and the identity of the individuals who provided information who had not consented to this disclosure. Section 23 of PIPA required Compass to withhold this latter information, but Compass was required to provide the applicants with access to their personal information if it was able to remove the information that had to be withheld. The Commissioner noted which portions of the documents must be redacted and ordered Compass to disclose the rest.
This case is a reminder that the disclosure obligations for organizations under PIPA are significant, and the net that PIPA casts over personal information is broad. Personal information is defined as any information about an identifiable individual with only very narrow exceptions. In this case, it encompassed job application records, some of which were provided by the applicants themselves.
As a matter of procedure, if an organization considers that a disclosure request is frivolous or vexatious, it should ask the Commissioner for authorization to disregard the request prior to responding in any way.
Finally, organizations cannot refuse to disclose records containing personal information on the basis that they contain protected information under PIPA if those portions can be redacted.