Bank accused of withholding credit agency information about credit applicant

PIPEDA Case Summary #2002-58

[Principles 4.9 and 4.9.4, Schedule 1; and sections 8(3) and 8(5)]

Complaint

An individual complained that a bank had refused him access to personal information that it had collected and used in turning down his application for credit.

Summary of Investigation

On July 30, 2001, the complainant, an unsuccessful applicant for a credit card, wrote requesting that the bank give him access to the information it had used in making the decision to refuse him credit. In September, still having received no response from the bank, he filed his complaint with the Commissioner's Office. At the Office's intervention, the bank wrote informing him of the reason why his application had been turned down, but merely referring him to two credit reporting agencies for further details about his credit file.

The complainant was not satisfied with this response, because he believed that the bank itself was obliged under the Personal Information Protection and Electronic Documents Act to directly provide him with the information it had collected about him from any credit reporting agency. The Office agreed with the complainant and advised the bank that, unless it intended to rely on one of the Act's exempting provisions, it should give him access to all the information he had requested. After a lengthy review of the matter, the bank decided to honour the complainant's request and, on April 2, 2002, released to him the information it had obtained from a credit reporting agency and used in considering his credit application.

The complainant was still not satisfied, protesting that the information released to him was not the same as that used by the bank in making the decision to refuse him a credit card. On comparing the original credit report from the agency with the report released to the complainant, the Office determined that there were two differences: (1) the released report included a legend explaining the meaning of codes and acronyms and the manner in which the Bank had interpreted the complainant's credit score; and (2) the released report had been translated into French, the complainant's language of preference. The Office advised the complainant that the reports were otherwise alike and that both of the differences in his received report were consistent with Principle 4.9.4 of Schedule 1 to the Act.

Commissioner's Findings

Issued July 2, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.9 states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and be given access to that information. Principle 4.9.4 stipulates, in part, that requested information must be provided or made available in a form that is generally understandable; for example, an explanation must be provided if the organization uses abbreviations or codes to record information. Sections 8(3) and 8(5) state, respectively, that an organization must respond to a request within 30 days of receipt and that failure to respond within the time limit is deemed to be a refusal.

The Commissioner determined that the bank had responded to the complainant's access request 216 days beyond the prescribed time limit. He found therefore that the bank clearly had not met its obligation under section 8(3) and was thus deemed under section 8(5) to have refused the request in contravention of Principle 4.9.

Nevertheless, the Commissioner was satisfied that, with the intervention of his Office, the bank had eventually given the complainant all the information he had requested. The Commissioner was also satisfied that the alterations made to the information as provided to the complainant were fully in keeping with the bank's obligation under Principle 4.9.4 to provide requested information in an understandable form.

The Commissioner concluded the complaint was well-founded and resolved with respect to Principle 4.9 and sections 8(3) and 8(5) and not well-founded with respect to the relevant part of Principle 4.9.4.