Applicant for service objects to providing credit card or bank account information

PIPEDA Case Summary #2002-48

[Principle 4.3.3, Schedule 1; section 5(3)]

Complaint

An individual complained that an organization had improperly attempted to collect credit card or bank account information from her as a condition of the supply of service.

Summary of Investigation

When the complainant called about an advertised special offered by a division of the organization, a representative told her that she could choose one of only two payment options: (1) monthly charges against a credit card; or (2) automatic monthly debits against a personal bank account. Having previously been a victim of fraud, the complainant objected to giving her bank account or credit card information for the purpose of processing payments. Instead, she proposed paying by certified cheque in advance. The representative told her that prepayment was not an option for the single service she had inquired about, but that it would be available as an option if she subscribed to a combined package of services.

Rejecting this suggestion as too expensive, the complainant asked to speak with a supervisor, who confirmed the two-option payment policy for the single service in question. From her conversations with representatives, the complainant took the impression that there was indeed a prepayment option, but she would only be allowed to use it if she agreed to upgrade to a more costly service package.

Although part of a larger corporation, the division offering the special has separate administrative functions such as billing. Unlike the rest of the corporation, the division does not have a billing system capable of handling prepayments or processing cheques. The combined service package was in fact a promotional feature that the division was offering by special arrangement with another division of the corporation. Payments for the combined service package were handled by that other division through the corporation's main billing system. Had the complainant subscribed to the combined service package, she could have paid in advance, but her payments would have applied to her usage of the combined services, not just the single service that she had originally sought.

The division's website confirms that customers are offered only two payment options for the single service in question. The complainant was denied service not because she had refused to provide personal information, but rather because she had refused to take one of the available payment options. The division had explained that limiting its billing system to two automatic monthly payment options was a business decision based on cost and efficiency.

Commissioner's Findings

Issued April 29, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Collection and Electronic Documents Act applies to federal works, undertakings, or businesses. The Commissioner had jurisdiction in this case because the corporation in question is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.3.3, Schedule 1, states: "An organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes." Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Regarding Principle 4.3.3, the Commissioner determined that the division did explicitly state in its communication with customers, both through its call-in centre and on its website, that it offered only the two payment options in question for the service the complainant had been seeking. He also determined that the bank account or credit card information collected by the division was required for the legitimate purpose of processing payments for service and was used only for that purpose. He found therefore that the organization had met its obligations under Principle 4.3.3.

Regarding section 5(3), the Commissioner was satisfied that a reasonable person would consider the processing of payments for service to be an appropriate purpose for the collection and would expect the organization to determine its own billing options. He found therefore that the organization was also in compliance with section 5(3).

The Commissioner concluded that the complaint was not well-founded.