RE: Request to Access Personal Information Dear Teksavvy User
Total Page:16
File Type:pdf, Size:1020Kb
TekSavvy Solutions Inc 800 Richmond Street TELEPHONE +1 519 360-1575 FAX 519.360.1716 Chatham ON N2M 5J5 TOLL FREE 1 877-779-1575 teksavvy.com Bram Abramson Legal & Regulatory Direct Line +1 647 479-8093 [email protected] RE: Request to Access Personal Information Dear TekSavvy User: Thank you for requesting a copy of records containing information directly associated with your name, phone number, e-mail, or account number. This is TekSavvy’s response. It consists of: A. background about this response; B. a description of our policies and practices with respect to the management of personal information, including responses addressing each type of specific record you asked about; C. an overview of the attached report, in light of the above; and D. a PDF containing records responsive to your request. Items A through C are set out below. Item D is provided in a separate document. A. Background I would first like to apologize both for this letter’s impersonal nature and for its longer-than- hoped-for response time. The volume of access requests we have received has made it impracticable to prepare a separate cover letter for each one, and has made the timelines under which we must prepare it challenging. I would like to explain why. We have received two waves of access requests based, like yours, on a template relying on Principle 9 (“Individual Access”) of the Model Code for the Protection of Personal Information which, reproduced at Schedule 1, section 4.9 of the Personal Protection and Electronic Documents Act (“PIPEDA”), is given force by sections 5 and 8 of the same Act. The first day of the first wave of such requests, which followed online publication of the template you used, saw more requests than TekSavvy had, by all accounts, previously received in its history as a company. The second wave of these requests was enabled by an online web form allowing these templates to be filled in and emailed in a few keystrokes, and in turn dwarfed the first wave. Put simply, we have been swamped. Principle 9 requires us to inform individuals of the existence, use, and disclosure of their personal information and give them access to that information, attempting to be as specific as possible, within a reasonable time and at minimal or no cost to the individual. Section 8 sets out the procedural rules by which such information is to be provided. In developing our response to templated access requests like yours, we reviewed the Model Code scheduled to PIPEDA, section 8 of PIPEDA, and some of the surrounding case decisions and summaries, and took note of the following. - 2 - First, organizations which receive access requests under Principle 9 may extend them in certain circumstances. For instance: where meeting the 30-day time limit would unreasonably interfere with the activities of the organization receiving the request, the organization may extend the time limit for a maximum of 30 days,1 and if the personal information is to be converted into an alternative format, then the organization may extend the time limit for “the period that is necessary in order to be able” to do so.2 We have revised our organization’s activities in order to work to meet PIPEDA’s deadlines as nearly as possible. A significant portion of our effort has been related to converting the personal information requested into a format that could be outputted within a reasonable timeframe. So, while we have moved as expeditiously as we are able, you should know that both of the above circumstances were in place. Second, organizations seeking to respond to very broad information requests that could be extremely far-reaching and even prohibitively costly to fulfill are given two options. They can (a) ask the requesting party to be more specific, or (b) conduct a reasonable search of information that is reasonably responsive to the request made, such as by searching the information collected, used, and disclosed in the course of ordinary business operations.3 Given the content and context of the template you used, we came to the conclusion that the second option was the better approach. In particular, we concluded that access requests based on the template were likely intended to obtain better information in view of reports of enormous volumes of information disclosed by certain Canadian telecommunications companies to state agencies.4 We have therefore conducted a reasonable search of information collected, used, and disclosed in the course of our business operations. Third, adjacent to Principle 9 (“Individual Access”), under which your access request was filed, the Model Code also advances a Principle 8 (“Openness”) stating that “[a]n organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information”, including: a) the name or title, and the address, of the person who is accountable for the organization's policies and practices and to whom complaints or inquiries can be forwarded; b) the means of gaining access to personal information held by the organization; c) a description of the type of personal information held by the organization, including a general account of its use; 1 S.C. 2000, c. 5, sub-paragraph 8(4)(a)(i). 2 Paragraph 8(4)(b). 3 Johnson v. Bell Canada, 2008 FC 1086. 4 See, e.g., Christopher Parsons, “The Murky State of Canadian Telecommunications Surveillance”, March 6, 2014 (online: https://citizenlab.org/2014/03/murky-state-canadian- telecommunications-surveillance/), and Openmedia.ca, n.d. “Request access to your personal information” (online: https://openmedia.ca/myinfo). - 3 - d) a copy of any brochures or other information that explain the organization's policies, standards, or codes; and e) what personal information is made available to related organizations (e.g., subsidiaries). The broad-ranging nature of the requests we received may also have reflected the potential perception that information about our own policies and practices relating to the management of personal information were difficult to find so that, rather than ask for further information about those policies, you chose instead to ask about the specific information that pertains to you that arises from those policies and practices. We have therefore included, in Part B of this cover letter, information responsive to Principle 8 (“Openness”) about TekSavvy’s policies and practices relating to the management of personal information. But we also invite you to consult our privacy policy as it currently stands,5 and the more detailed information which we provided in early June6 and which is the initial portion of an update we will complete later this year to that policy. Based in part on our approach to the three items described above, we began responding to the first wave of templated access requests manually, based on the records to which we have access by searching the information collected, used, and disclosed in the course of ordinary business operations. I estimate that fulfilling each such response took at least six hours.. The second wave of templated access requests made it clear that we would no longer be able to respond to them manually, as it would not have been possible to meet these requests within 30 nor, likely, within 60 days. Ironically, our systems are simply not set up to provide the ease of access to your personal information that fulfilling these requests quickly requires. We therefore instead reallocated software development resources to automating as much of this process as possible within a month. The attached records reflect the results of reports which we now have the ability to generate automatically, although not instantly. We have not yet been able to automate the conversion of certain information into a format that can be detached from our internal systems. In particular: We continue to work towards automating the correlation of IP addresses to subscriber name and account, which is challenging, particularly in view of the range of access networks with which we interact and there heterogeneous systems in place for enabling access on them. That automation is not complete. As a result, if you are an Internet access subscriber then, unless you have purchased the use of a static IP address that does not change, the attached report does not include IP address logs which are generated and stored for a limited time by our systems. We have therefore set out below our policy, which we hope will address your general concerns. Should you require your IP address correlation records, please let us know, and we will task a team member with generating them as soon as we can. 5 Online: <http://teksavvy.com/en/why-teksavvy/policies/privacy-policy>. 6 Publication of detailed responses to a questionnaire on our personal information policies and practices, which we invite you to consult, was intended in part to address that potential perception. Online: <http://teksavvy.com/Media/Default/Citizen%20Lab/TekSavvy%20to%20Citizenlab%20- %202014-06-04.pdf> - 4 - Our marketing systems, including our CASL tracking information, are maintained separately, and their setup is such that automating the production of records that can be detached from our internal systems, which is very challenging, was well beyond the scope of what we were able to accomplish in 30 days. Here, too, we have therefore set out our policy and, in addition, provided screen shots in order to show you the type of information we collect, but also invite you to inform us should you require your specific information. However, we hope you will first review the information below, and attached report attached, to assess whether it satisfies your requirements. B. Policies, Practices, and Records Our approach to the management of personal information is bound, as well as by PIPEDA, by our network management policies and by the CRTC’s confidentiality provisions.