James v. Amazon.com.ca, Inc.

James v. Amazon.com.ca, Inc.
Court (s) Database
Federal Court Decisions
Date
2023-02-03
Neutral citation
2023 FC 166
File numbers
T-1335-22
Decision Content
Date: 20230203
Docket: T-1335-22
Citation: 2023 FC 166
Ottawa, Ontario, February 3, 2023
PRESENT: The Honourable Mr. Justice Roy
BETWEEN:
TAMARA JAMES
Applicant
and
AMAZON.COM.CA, INC.
Respondent
JUDGMENT AND REASONS
I. Overview
[1] The Personal Information Protection and Electronic Documents Act, SC 2000, c 5, better known as PIPEDA, is legislation created for the protection of the personal information. As section 3 of PIPEDA spells out, it aims to balance the protection of personal information while allowing organizations to collect, use or disclose personal information. Section 3 reads as follows:
Purpose
Objet
3 The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
3 La présente partie a pour objet de fixer, dans une ère où la technologie facilite de plus en plus la circulation et l’échange de renseignements, des règles régissant la collecte, l’utilisation et la communication de renseignements personnels d’une manière qui tient compte du droit des individus à la vie privée à l’égard des renseignements personnels qui les concernent et du besoin des organisations de recueillir, d’utiliser ou de communiquer des renseignements personnels à des fins qu’une personne raisonnable estimerait acceptables dans les circonstances.
[2] The Applicant, a litigant in person, invokes PIPEDA to gain access to the personal information held by the Respondent, Amazon.com.ca, Inc. (hereinafter “Amazon”). She says that it is her personal information. Amazon claims that it is prevented by PIPEDA from disclosing to the Applicant the personal information it holds until and unless it has been able to authenticate that the person seeking access is the person who is entitled to it. As can be seen, the sad irony is that both parties rely on PIPEDA for purposes diametrically opposed: one claims that PIPEDA creates an obligation to disclose to her while the other party claims it cannot disclose without being in violation of the same PIPEDA.
[3] The Applicant, Ms. Tamara James, brings her dispute with Amazon before this Court pursuant to section 14 of PIPEDA:
Hearing by Court
Audience de la Cour
Application
Demande
14 (1) A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1 or 1.1, in subsection 5(3) or 8(6) or (7), in section 10 or in Division 1.1.
14 (1) Après avoir reçu le rapport du commissaire ou l’avis l’informant de la fin de l’examen de la plainte au titre du paragraphe 12.2(3), le plaignant peut demander que la Cour entende toute question qui a fait l’objet de la plainte — ou qui est mentionnée dans le rapport — et qui est visée aux articles 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 ou 4.8 de l’annexe 1, aux articles 4.3, 4.5 ou 4.9 de cette annexe tels qu’ils sont modifiés ou clarifiés par les sections 1 ou 1.1, aux paragraphes 5(3) ou 8(6) ou (7), à l’article 10 ou à la section 1.1.
Time for application
Délai de la demande
(2) A complainant shall make an application within one year after the report or notification is sent or within any longer period that the Court may, either before or after the expiry of that year, allow.
(2) La demande est faite dans l’année suivant la transmission du rapport ou de l’avis ou dans le délai supérieur que la Cour autorise avant ou après l’expiration de l’année.
For greater certainty
Précision
(3) For greater certainty, subsections (1) and (2) apply in the same manner to complaints referred to in subsection 11(2) as to complaints referred to in subsection 11(1).
(3) Il est entendu que les paragraphes (1) et (2) s’appliquent de la même façon aux plaintes visées au paragraphe 11(2) qu’à celles visées au paragraphe 11(1).
[4] In Miglialo v Royal Bank of Canada, 2018 FC 525 [Miglialo], I commented in the following fashion about the Court’s role in determining an application under section 14 of PIPEDA and the burden of proof:
[21] An application under section 14 of PIPEDA is not a judicial review of the Commissioner’s Report, but the Report may be entered into evidence as was the case here. The scope of the application is prescribed by law. The Court is limited to the matters in respect of which the complaint about the violation of principles was made or that are referred to in the Commissioner’s Report. Although the application is said to be a de novo action, it must be dealt with in a summary manner. The Court is engaged in a fact-finding process to determine whether the respondent violated one or more of the principles (Randall v Nubodys Fitness Centres, 2010 FC 681 [Randall]). Once a violation has been established, the Court has discretion under section 16 of PIPEDA to award damages on a principled basis that will be appropriate and just in the circumstances (Nammo v TransUnion of Canada Inc., 2010 FC 1284 [Nammo]). The burden of proof rests on the applicant.
[22] That means in the circumstances of this case that the applicant must establish the damages suffered and that they were caused by the violation (Biron v RBC Royal Bank, 2012 FC 1095 [Biron], at para 38). Here, the applicant claims that there was an unauthorized use of her financial information and that there was disclosure of that information. As for the use, it is not contested by RBC that there was one such occurrence, on February 24, 2013. Thus, the applicant must show that there was disclosure of her information if she is to prevail on that front. It will also be for the applicant to satisfy the Court of the damages she claims she suffered as a result of the violation.
It follows that the burden is on the Applicant to show a violation of PIPEDA on a balance of probabilities, using evidence that is clear, convincing and cogent. Cases usually are concerned with disclosure of information that is unauthorized. Such is not the case here.
[5] Moreover, the ability of the Court to entertain matters pursuant to proceedings under section 14 is limited by the section itself (Miglialo, at para 31). It must be concerning a matter in respect of which the complaint before the Privacy Commissioner was made, or it could be in respect of a reference made in the Commissioner’s Report. It would be inappropriate for an applicant to seek to go beyond the parameters of section 14.
II. The Facts
[6] The Applicant, Ms. Tamara James, claims that she became a customer of the Respondent after creating an account online with Amazon (the “Account”).
[7] The Respondent is an online retailer in Canada. The Respondent carries on business as a subsidiary of its American affiliate Amazon.com, Inc. Amazon.com, Inc. is incorporated under the laws of Delaware, and has its headquarters located in Seattle, Washington (Applicant’s record, p 162).
[8] On August 15, 2020, the Applicant claims that she used the Account to purchase an Amazon Prime membership to renew on a monthly basis (Applicant’s record, p 19). It appears that the Applicant forgot the password associated with the Account.
[9] On August 31, 2020, the Applicant contacted Amazon via telephone after unsuccessful attempts to log in to the Account. She was advised that her identity could not be authenticated because the name, email, and mailing address she provided did not correspond with the information contained on the Amazon’s server (Applicant’s record, p 14). That day, she emailed Amazon’s customer service portal to request assistance with accessing her account. She also sought to change her password and cancel her Prime membership subscription (Applicant’s record, p 19).
[10] On September 1, 2020, the Applicant tried to recover her password twice by following Amazon’s two-factor authentication service. This involved requesting a One-Time Password (OTP) through the email address associated with the Account (Applicant’s record, pp 21-22). The Applicant claims that when she entered her OTP to authenticate herself, the Amazon website directed her to contact its customer service representatives by telephone (Applicant’s record, p 14).
[11] On September 2, 2020, the Applicant sent a letter via email to the customer service portal and by regular post to Amazon’s corporate headquarters in Seattle, Washington (Applicant’s record, pp 24-25). In the letter, the Applicant requested access to: (1) all of the information associated with the Account, (2) receipts from the transactions on the Account between August 10, 2020 and August 26, 2020, and (3) audio recordings of all her prior dealings with Amazon’s customer service representatives (Applicant’s record, p 25). An Amazon representative emailed her back that day, inviting her to access the requested invoices by logging into the Account. The representative also informed her that Amazon does not provide recordings of phone calls to its customers (Applicant’s record, p 26).
[12] By email dated October 22, 2020, the Applicant advised Amazon that it had a 30-day time limit to respond to her access for information request (Applicant’s record, p 28). She received a responding email that day, in which an Amazon representative asked for more information about the Applicant’s past purchases (Applicant’s record, p 29). Nothing in the record suggests that the Applicant responded to this request.
[13] On November 2, 2020, the Applicant filed a formal privacy complaint with the Office of the Privacy Commissioner of Canada (the “Commissioner”). She summarized her complaint in the following terms:
Amazon.com Inc is refusing to provide me with access to my personal information and refuses to provide receipts of online purchases requested in writing on September 2 2020.
(Applicant’s record, p 33.)
[14] In response to the question “What would resolve your complaint for you?”, the Applicant wrote: “Access to information requested, including copies of all receipts and copies of all my personal information held by Amazon.com Inc.” (Applicant’s record, p 33).
[15] The Applicant attached four documents to her formal complaint. Two of the documents are copies of the email and letter dated September 2, 2020, in which Ms. James initiated her request for access to the information associated with the Account. A third document is Amazon’s customer service representative’s email response to her request which she received on September 2, 2020 at 10:29 a.m. The final document is the Applicant’s follow up email dated October 10, 2020, in which the Applicant advised Amazon that it had 30 days to respond to her request.
[16] On November 10, 2020, an agent for the Privacy Commissioner responded to the Applicant’s complaint letter, instructing her to send her request to the Amazon Privacy Officer before pursuing her complaint with the Commissioner (Applicant’s record, p 35). The Commissioner provided the Applicant with the mailing address for Amazon’s Chief Privacy Officer and noted that if the issue was not resolved to her satisfaction, she could still pursue the complaint with the Commissioner provided that she deliver copies of correspondence between her and Amazon’s Privacy Officer (Applicant’s record, p 35).
[17] On November 13, 2020, the Applicant submitted her request to the Amazon Privacy Officer, using the address provided by the Privacy Commissioner (Applicant’s record, p 37). The record does not show whether Amazon responded.
A. The Disputed CIBC Credit Card Transaction
[18] In an affidavit made in support of her application (Applicant’s record, p 15), Ms. James states that on November 22, 2020, she disputed “all of the credit card transactions” related to her Amazon subscriptions from September to November 2020 (Applicant’s record, p 15, para 14). The record does not show how she raised her concerns with CIBC or what were the contested purchases. Ms. James attaches a seven-page exhibit (“Exhibit H”) to this section of her affidavit, which appears to include pages from several documents relating to one purchase the Applicant challenged with CIBC (Applicant’s record, pp 39-45).
[19] The first two pages of Exhibit H consist in a letter from CIBC addressed to “Tashesha James” dated December 11, 2020. CIBC wrote that it was following up on the Applicant’s request to challenge a $17.32 purchase for a product that was billed to her CIBC credit card on November 22, 2020. CIBC advised the Applicant that it would temporarily reimburse credit back onto her account and enclosed a copy of the transaction receipt that Amazon had provided to CIBC upon its request. CIBC provided two possible courses of action for Ms. James to pursue. Either she could dispute the transaction by completing an attached “Dispute Letter” by December 26, 2022, or, should she decide not to reply, CIBC would consider the matter resolved and remit the purchase back onto her credit card (Applicant’s record, p 39). The record is silent as to what developments there were.
[20] The next three pages of Exhibit H appear to be the copy of the Applicant’s bank statement and Amazon’s Merchandise Order Receipt (“Receipt”) relating to the transaction at issue. One detail emerges from this document. The Receipt states that the customer who purchased the product initiated the subscription order for the product on Saturday, November 7, 2020:
This order was placed automatically through an active Subscribe & Save subscription initiated by the customer on [Saturday, November 7, 2020]. (Applicant’s record, p 42.)
Order Placed Date and Time: Sat, Nov 7, 2020 02:41 PM PTS. (Applicant’s record, p 43.)
[My emphasis.]
[21] Although the subscription was ostensibly initiated on November 7, 2020, the transaction date for the order appeared to be on November 22, 2020, the same day that the order was shipped to the Applicant’s residence. The product was delivered to the Applicant’s residence on November 23, 2020.
[22] The evidence offered by the Applicant on that transaction is sparse. At the hearing and in her factum (para 32), the Applicant claimed that she had initiated the purchase on a monthly basis prior to her being locked out of the Account (i.e. prior to August 31, 2020). That may be so. However, nowhere in the materials does the Applicant provide evidence to substantiate the assertion. Nor is there evidence to the effect that Amazon charged her on an ongoing basis (before or after November 22, 2020). The Applicant did not provide any explanation as to how the subscription was “initiated” on November 7, 2020 as the document offered in evidence asserted, a time where she claims that she was blocked from accessing the Account. In other words, the evidence is incomplete and unclear with respect to that one transaction. Moreover, it remains unanswered whether the Applicant escalated the disputed transaction in accordance with the instructions set out by CIBC’s letter and what role, if any, the Respondent played in the resolution of the issue.
[23] The Receipt also provides that Amazon successfully delivered the merchandise to the cardholder. The “Notes” section of the Receipt states (Applicant’s record, p 42):
The merchandise was delivered to the verified address of the cardholder. The cardholder’s billing information matches the shipment information provided at the time the order was placed. Please review this information with your customer as this order appears to have been placed by someone with authorized access to the account.
The customer has successfully used this shipping address for 8 number of orders that were previously processed and are not disputed. This suggests the address is authorized by the customer.
In effect, it is unclear what that evidence shows other than Amazon was instrumental in delivering a product to someone living at the address given. CIBC appears to have communicated with “Tashesha James” who holds a CIBC credit card. Who ordered the product billed to the credit card is unknown, although a receipt for shipment indicates that the billing address is that of “Tashesha James” and the shipping address is that of “Tamara James”: both addresses are the same. At the hearing, the Applicant indicated she uses both names. Nevertheless, the documentation offered in evidence is careful to refer to the cardholder being the customer who provided the billing address. The customer is Tashesha James. Without more information about the dispute, such as who placed the order and when, who is the cardholder and what were the instructions given, the information provided by the Applicant concerning Amazon’s involvement is of limited use. In fact, the information does not contribute to enlightening a trier of fact.
B. The Privacy Complaint at Issue
[24] The complaint to the Privacy Commissioner of November 2, 2020 was made the subject of a reply by the Privacy Commissioner on November 10, 2020 (Applicant’s record, p 35). The suggestion was made therein for the Applicant to contact the Amazon Privacy Officer. That appears to be in line with section 12 of PIPEDA. Indeed, the Applicant followed up with a letter to the Chief Privacy Officer on November 13, 2020.
[25] Having directed the Applicant to contact Amazon Privacy Officer in November 2020, a privacy investigator for the Office of the Privacy Commissioner contacted the Applicant on June 9, 2021 to find out whether she still intended to pursue her complaint against Amazon. The Applicant confirmed that she did. It looks like that, other than the letter to the Chief Privacy Officer of Amazon of November 13, 2020, the Office of the Privacy Commissioner was not aware of developments, if any, between November 2020 and June 2021.
[26] On June 23, 2021, the Applicant received an email and phone call from “Eugenia S.”, an Amazon Executive Customer Service representative who was assigned to her file (Applicant’s record, p 52). The Applicant responded to this email two months later apparently, on August 31, 2021 (Applicant’s record, p 52). She attached the letter dated November 13, 2020 requesting access to the personal information associated with the Account.
[27] From September 15 to September 22, 2021, the Applicant corresponded with two members of the Amazon’s Executive Customer Relations team. The Applicant informed them that the issue related to her “invoices” was resolved (Applicant’s record, p 54). The details as to the resolution are lacking, including possible Amazon’s involvement, if any. However, she still sought access to the personal information held by Amazon on the Account, and again requested copies of audio recordings between her and Amazon customer service representatives (Applicant’s record, p 54).
[28] There were a number of interactions between Amazon and the Applicant, including with a lawyer from Amazon dealing with privacy compliance. Thus, the Respondent’s record shows two emails on September 22, 2021 where Amazon counsel reaches out to Ms. James in a further attempt to resolve the issue. The first email bears the date of September 22, 2021, at 14:22:
I understand that our Executive Customer Care team has been in touch with you regarding your access request. I wanted to personally reach out to let you know that I am working closely with the Executive Customer Care team, and to see how else I can be of assistance. Is my understanding correct that you would still like to submit a request for your personal information, but have been unable to verify your identity so as to gain access to your account?
The second email of the same day came at 17:02:
My team is responsible for privacy compliance. I am an attorney that supports Amazon.ca and Amazon.com. Nicole with the OPC previously provided us with your letter, and we have been trying to follow up with you on this request. We are more than happy to assist you, but we must verify your identity for privacy and security reasons before we grant you access to personal information. Would you like to arrange a call with me and a customer service representative to begin that process? Please let me know when you are available next week, and I will gladly arrange a time.
(Respondent’s record, p 15.)
[29] As can be seen from the second email message of September 22, 2021, the Applicant received an email from a Privacy Officer at Amazon, part of their legal team, who proposed arranging a call between herself, the Applicant, and a customer service representative. The Privacy Officer noted:
We are more than happy to assist you, but we must verify your identity for privacy and security reasons before we grant you access to personal information.
(Applicant’s record, p 62.)
[30] A phone call was scheduled for, and took place on, September 29, 2021. On the call, the Applicant was informed that since she could not remember her password, she could gain access by resetting her password, a process that involved agreeing to Amazon’s updated Terms of Service. In an email that the Applicant sent to the Privacy Commissioner in late afternoon on October 12, 2021, after she was advised earlier that the complaint would not be pursued by the Privacy Commissioner, the Applicant describes her version of events on the call as follows:
On September 29, 2021 at exactly 1:30pm, I spoke with a representative for Amazon concerning this matter. That conversation was recorded and should be available upon request. The additional information that the representative asked for a password, which I could not provide as I do not remember the password to the account. For me to gain access to the account in question at this time, I will be required to agree to Amazon’s updated Terms of Service. My refusal to agree to Amazon’s continued collection of my personal data is not a valid reason to deny access to already existing data.
(Applicant’s record, p 66.)
[Emphasis added.]
[31] As we shall see later, it is unknown why the Terms of Service might be an issue. The Respondent’s Privacy Officer had explained in a long email message to the Applicant (Applicant’s record, p 64) of that same October 12, that Amazon could not grant the requested information because the Applicant was unable to authenticate the correct name of the account holder, and the mailing/billing address associated with the Account. The Amazon Privacy Officer also noted that during their September 29, 2021 phone call, the Applicant refused to provide additional information, indicated she did not want a customer service representative to call her back, and did not want to proceed with a self-service option. The Privacy Officer offered to assist the Applicant. She concluded her email of October 12, 2021 by providing the Applicant a clickable hyperlink to reset her password, should she wish to do so. She was advised that once she has been able to obtain her personal information, she could close her account and delete her information. The three paragraphs from the email are reproduced:
I am writing in response to your letters dated 11/13/2020 and 9/22/2021, in which you request access to personal information associated with the email address REDACTED. First, I want to apologize for any confusion, frustration or difficulty that you have experienced. I understand that you had a very negative experience and I want to assure you that we have taken your feedback into account and are deep-diving ways to improve the customer experience associated with information requests.
Unfortunately, we cannot grant you access to the information you have requested because we cannot verify your identity. On calls with your customer service representatives, you were unable to verify the name of the account holder and the mailing or billing address associated with the account. When we spoke on 9/29, you indicated that you did not wish to provide additional information, did not want a customer service representative to call you back, and did not want to proceed with our self-service options. If you change your mind, I am happy to assist you.
For reference, you can change the password to your account using your email address by following the instructions here. Once your password is changed and you can login to your account, you can go to our Request Your Personal Information help page and follow the instructions to have a copy of your personal information emailed to you. You can also request the closure of your account and the deletion of your personal information.
[Emphasis in the original.]
[32] The Privacy Commissioner investigator had been copied on the email from Amazon to the Applicant on October 12, 2021. That is when she informed the Applicant that the Commissioner would not investigate further her complaint. Given that the Applicant was unable to provide the information requested by Amazon, the Privacy Commissioner investigator believed that it was “fair and reasonable that an organization [authenticate] an individual before giving information on an account” (Applicant’s Record, p 66). The investigator’s email of October 12 states that “Unfortunately since you were unable to provide the information, we will not pursue with this complaint”. A follow up email, further to the Applicant’s late afternoon email response, referred to in paragraph 30 of these reasons for judgment, was sent on October 13, 2021 by the Privacy Commissioner investigator, suggesting that the Applicant collaborate with Amazon to reset her password and obtain access to her personal information (Applicant’s record, p 67). The October 13 email reads:
Following the email you sent me yesterday, I had a telephone conversation today with Amazon’s Privacy Officer. She said that she personally informed you by telephone on her personal cel [sic] phone since she works from home (not recorded) why they could not authenticate you. She confirmed that the information you have provided to her colleague does not match what they have on file so they could not authenticate you. Since that information did not match, they required your password which you said you did not remember it. For that reasons they suggested that you reset your password as indicated in her email to you dated September 28, 2021.
Ms. James, we suggest that you collaborated with Amazon and reset your password and then you will be able to access your personal information. Our Office does agree that organizations needs [sic] to authenticate individuals to protect them if a third party tries to access their personal information.
[33] By an email dated October 16, 2021, the Applicant informed the Privacy Commissioner investigator that she would seek a reconsideration of the Commissioner’s decision. I reproduce in its entirety the email sent by the Applicant to the investigator. It appears to encapsulate the Applicant’s position:
Since September 2020, I have made numerous attempts to authenticate my identity by providing personally-identifiable information associated with the account in question, including full name, current and previous mailing addresses, telephone number and email.
On 11 December 2020, Amazon was able to resolve a dispute related to a credit card transaction by proving to my credit card provider that an item had been successfully delivered to Tamara James at the very address which it now falsely claims cannot be authenticated. If the information on the account was modified in any way, it was done so without my knowledge and is likely the result of an error on the part of Amazon.com.
After refusing for several months to respond to my request for access, Amazon now asks that I reset the password on the account and accept its updated Terms of Service in order to authenticate my identity and to access the information requested. However, as I have no interest in using the services of Amazon.com, I cannot accept the updated Terms or consent to the continued collection of my personal information by Amazon.com.
So, according to Amazon, and the OPC agrees, I cannot access my personal information unless I agree to use Amazon’s automated online service; to access that service, I must authenticate my identity by using only a password; and to obtain that password, I must first authenticate my identity, which I am not able to do as Amazon continues to claim that none of the information that I have provided can be authenticated.
As the OPC fails to comprehend the inherent flaws in Amazon’s policy regarding privacy and access to information and has therefore declined to investigate the complaint without valid reason in accordance with section 12(1) of PIPEDA, I will be seeking reconsideration of the decision. Thank you.
(Applicant’s record, p 68.)
The Applicant did not address how the Terms of Service are in issue as the point was made by Amazon’s Privacy Officer in the last email to Ms. James, on October 12, that she could request the closure of her account and delete the personal information. She does elaborate either on how the dispute over the credit card charges was resolved.
[34] On November 9, 2021, the Applicant submitted a “Request for Reconsideration” of the Commissioner’s decision to decline to investigate her complaint (Applicant’s record, pp 70 to 73). There is no indication that a reconsideration was even conducted.
III. What does the Complaint say?
[35] As already seen, the contents of a complaint are an essential parameter concerning the jurisdiction of this Court to hear a matter pursuant to section 14 of PIPEDA. The complaint to the Privacy Commissioner (section 12 of PIPEDA) was framed in the following fashion (Applicant’s record, pp 32-33). The form filled out by Ms. James, which constitutes the complaint, specifically refers to being denied access to her personal information by Amazon.com, Inc., headquartered in Seattle, Washington. Ms. James indicates that she made requests on three dates: August 31, 2020, September 2, 2020 and October 22, 2020. It appears that the most relevant date is September 2 as the Applicant summarizes her complaint to the Privacy Commissioner: “Amazon.com, Inc. is refusing to provide me with access to my personal information and refuses to provide receipts of online purchases requested in writing on September 2, 2020”. That appears to be the core of her complaint, as the record shows.
[36] We learn of some of the details in the section of the complaint dedicated to attempts made to resolve the issue. Thus, the Applicant claims that she attempted to contact Amazon starting on August 28, 2020 to gain access to information in possession of Amazon; she was told that her mailing address could not be verified. On September 2, 2020, the Applicant wrote to Amazon Corporate Headquarters, in Seattle, asking for copies of receipts for purchases between August 10 and August 26, 2020, as well as audio recordings of telephone communications between August 30 and September 1, 2020 involving her and Amazon’s customer service team. The Applicant referred to a particular email address. She also referred directly to Principle 9 of PIPEDA, as well as to the obligation for organizations, such as Amazon, to provide access to personal information within 30 days.
[37] The complainant acknowledges she received a response from Amazon the same day the request for personal information was made (September 2, 2020). It seems that the communication was to the effect that the mailing address given by the Applicant to verify before giving access to the account was not satisfactory in order to verify properly. On October 22, 2020, the Applicant again provided addresses (her current address and a previous one). Amazon replied to her email. The Applicant contends in her complaint to the Privacy Commissioner that “(i)t is a well known fact that Amazon.com, Inc. collects and stores extensive data on all its customers. It is not at all possible that Amazon.com, Inc. is unable to locate my personal information using either the email address or the mailing address that I provided”. I note that the reply email of Amazon asked for it be provided with the “order information like (Order ID, product name, when the order was placed and amount that has been paid for the order), using this information we could easily able [sic] to locate the order” (Applicant’s record, p 29). Ms. James says in her complaint that this kind of information was not available to her because “I was not provided with neither receipts nor email confirmation of my orders”.
IV. The Case for the Applicant
[38] Ms. James seeks, among other things, a declaration the purpose of which is to compel the Respondent to comply with clauses 4.6.1, 4.6.3, 4.9.4 and 4.9.5. The Applicant alleges violation of two principles: denial of access to her personal information and the right to accurate information. She also seeks the payment of $218.12 which she calls compensatory damages, but are in reality her disbursements. Exemplary damages situated at .001% of the net income of the Respondent for the quarter ending on June 30, 2022, “for ethical and deliberately deceptive privacy practices” were sought. Neither party was able to communicate to the Court what that amount may be. Be that as it may, the Applicant relented from that amount at the hearing of the case.
[39] Although the Notice of Application does not refer specifically to section 8(3) of PIPEDA, which sets a limit of 30 days to respond to a request, with the possibility of an extension (section 8(4) of PIPEDA), it refers generally to contravention of Division 1 of PIPEDA, where section 8 is located. Furthermore, some of the material appended to the formal complaint refers to timeliness.
[40] The Applicant’s contention is that she did not receive her personal information within a reasonable time (clause 4.9.4) or no more than thirty days after receipt of the request (section 8(3)) if there is no extension of time limit in accordance with section 8(4).
[41] The Applicant notes that she made three written requests over time (September 2, 2020; November 13, 2020; September 22, 2021) for access to private information. The three letters are identical except for the signature block of the third letter that uses the name “Tashesha Tamara James”. There is no explanation for that change. As already stated, at the hearing, Ms. James confirmed using both names. Actually, an examination of the record reveals that the Applicant seems also to have used two different email addresses to communicate with the Respondent. It appears that she changed address at some point.
[42] Ms. James was in fact in contact with customer service representatives very soon after her initial request in September 2020. However, the record shows that, throughout, the Respondent was not able to verify that this Applicant was entitled to access the personal information it held with respect to a particular account. As already alluded to, the record does not show why that was. There was no information that was provided by either party as to what was the content of the various interactions between the Applicant and the Respondent’s representatives. That continues to be a mystery. Nevertheless, in effect, the Applicant received a response within the initial 30 days: she was not left with no response. However, she did not receive the information she was seeking.
[43] The Applicant’s argument is that “none of the customer service representatives who communicated with the Applicant were designated to act on behalf of a privacy officer, nor were they even aware of the organization’s policies and procedures for handling written requests” (memorandum of fact and law, para 23). That is why, says the Applicant, the communications are not a legitimate response to the complaint. No authority for that proposition was offered.
[44] Next, it is argued that the Respondent did not comply with Principle 6 which is concerned with the accuracy of personal information. Ms. James is right that the Principles set out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, which are found in schedule 1 to PIPEDA, must be complied with (section 5 of PIPEDA). A violation of Principle 6 is covered by section 14 of PIPEDA. As I pointed out during the hearing of this case, the emphasis is of course on the protection of personal information in PIPEDA, but there is a requirement that the personal information be kept accurate. The Applicant sought to rely on Principle 6. I reproduce Principle 6 in its entirety:
4.6 Principle 6 — Accuracy
4.6 Sixième principe — Exactitude
Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
Les renseignements personnels doivent être aussi exacts, complets et à jour que l’exigent les fins auxquelles ils sont destinés.
4.6.1
4.6.1
The extent to which personal information shall be accurate, complete, and up-to-date will depend upon the use of the information, taking into account the interests of the individual. Information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.
Le degré d’exactitude et de mise à jour ainsi que le caractère complet des renseignements personnels dépendront de l’usage auquel ils sont destinés, compte tenu des intérêts de la personne. Les renseignements doivent être suffisamment exacts, complets et à jour pour réduire au minimum la possibilité que des renseignements inappropriés soient utilisés pour prendre une décision à son sujet.
4.6.2
4.6.2
An organization shall not routinely update personal information, unless such a process is necessary to fulfil the purposes for which the information was collected.
Une organisation ne doit pas systématiquement mettre à jour les renseignements personnels à moins que cela ne soit nécessaire pour atteindre les fins auxquelles ils ont été recueillis.
4.6.3
4.6.3
Personal information that is used on an ongoing basis, including information that is disclosed to third parties, should generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out.
Les renseignements personnels qui servent en permanence, y compris les renseignements qui sont communiqués à des tiers, devraient normalement être exacts et à jour à moins que des limites se rapportant à l’exactitude de ces renseignements ne soient clairement établies.
[45] The argument seems to be that since the Applicant cannot authenticate the connection between herself and the account at Amazon, it must be that the information held by Amazon is inaccurate. That, claims the Applicant, constitutes a violation of Principle 6.
[46] On this record, and purely factually, the Court has not been able to find any support in the evidence for what may be referred to as speculation if not supported by evidence. Ms. James in effect speculates that, if she was not able to gain access to what she says is her Amazon account, it must be because the Respondent did not have accurate information. It is certainly possible that the information held by Amazon is not accurate. However, the evidence in support is not part of this record. The Applicant suggests in her memorandum of fact and law that she requested assistance to determine what personal information had been modified, when and by whom the information ha