The Performance File and the 30-Day Clock
Priya is a senior account manager at a federally regulated bank in Toronto. After being placed on a performance improvement plan, she emails the privacy office requesting 'my complete employee file, including every email my manager sent about me, investigation notes, and the restructuring spreadsheet that shows my role is being eliminated.' The bank has 400 pages of responsive records: performance reviews, attendance notes, 60 pages of manager emails (some discussing other employees), 12 pages of legal advice from outside counsel about Priya's human-rights complaint, and a confidential commercial spreadsheet with client revenue projections. The request arrived on 3 March. The privacy office has one analyst and a 20-day internal service standard. Priya has not asked for a specific format. Her manager wants to withhold all emails as 'confidential' and the legal team wants to withhold the entire spreadsheet.
1. What are the bank's obligations under PIPEDA on timing, format and duty to assist? Can it extend the 30-day period?
Read the worked answer
PIPEDA requires the bank to respond to an access request within 30 days, unless it extends the period. The 30 days run from the request, so a 3 March request is due by 2 April. The internal 20-day standard is a service target, not a legal deadline, and cannot be used to justify delay. The bank has a duty to assist, which means making a reasonable effort to identify and retrieve records, offering a reasonable format, and not requiring Priya to narrow the request merely to make the file easier.
The bank may extend the 30-day period if doing so is necessary because of the volume of records, the need to consult, or similar reasons. It must notify Priya within the original 30 days, give the new date, and explain the reason for the extension. An extension is not automatic and should be proportionate; 400 pages with third-party and privilege review may justify a short extension, but the bank should not use the extension to conduct an indefinite review.
The bank should acknowledge the request promptly, confirm the scope, and tell Priya whether it needs clarification. It should also offer a format; if the records exist electronically, a searchable PDF or electronic copy is reasonable. The response must include reasons if any information is withheld.
2. Apply the PIPEDA exemptions to the manager emails, legal advice and restructuring spreadsheet. What should be released or redacted?
Read the worked answer
The manager emails cannot be withheld as a category. PIPEDA permits withholding information that is subject to solicitor-client privilege, confidential commercial information, or information about another individual where disclosure could harm that individual or is not necessary. Emails about Priya's performance are her personal information and should be released. Emails that discuss other employees should be redacted to remove third-party personal information unless the other person consented or the information is necessary to understand Priya's file. A blanket claim that emails are 'confidential' is not a lawful exemption.
The 12 pages of legal advice from outside counsel are likely privileged and can be withheld, but the underlying facts must still be released. The bank should identify the privilege claim precisely and sever factual attachments or factual summaries where they can be separated. The spreadsheet is mixed. Client revenue projections may be confidential commercial information if disclosure could harm the bank's competitive position and the information is consistently treated as confidential. However, Priya's own role, salary, performance rating and severance estimates are her personal information and should be released, with genuine commercial data redacted.
The response should sever rather than withhold whole documents, provide an index of what was withheld and why, and document the reasoning. The manager's demand to withhold all emails should be declined with an explanation of the duty to assist and the limited exemptions.
3. How should the bank document the response and handle the manager's demand to withhold all emails?
Read the worked answer
The privacy office should create a request file with the original request, scope decisions, search terms, records retrieved, a page-by-page redaction log, the legal basis for each redaction, and the approval of the privacy officer or delegate. The log should distinguish third-party personal information, solicitor-client privilege and confidential commercial information. This documentation supports the response, demonstrates accountability, and is essential if Priya complains to the OPC.
The manager's demand should be handled as a disagreement about application of the law, not as a veto. The privacy office should explain that performance emails about Priya are her personal information, that confidentiality is not itself an exemption, and that the bank must sever only the genuinely exempt parts. If the manager believes disclosure would harm a third party, the manager should identify the specific passage and the harm, and the privacy office should assess it. The legal team should do the same for privilege rather than withholding the spreadsheet wholesale.
Finally, the bank should preserve the records because of the human-rights complaint and potential litigation. The access response should be completed without waiting for the litigation, and the response letter should explain any extension, redactions and format. Retaliation risk should be considered separately from the access decision.