Couple objects to agency's delayed response to requests for credit histories

PIPEDA Case Summary #2002-59

[Principles 4.9, Schedule 1; and sections 8(3) and 8(5)]

Complaint

A husband and wife complained that a credit reporting agency had failed to respond to their requests for access to their personal credit histories.

Summary of Investigation

The complainants made written requests for copies of their credit histories on December 1, 2001. In a letter of acknowledgment, the agency in question stated that the requests could not be processed within 30 days because of increased volume at the time. This letter also notified the complainants of their right to complain under the Personal Information Protection and Electronic Documents Act. When the complainants still had not received their credit reports by mid-January, they filed their complaints with the Commissioner's Office.

The agency had indeed been experiencing a significant increase in the volume of access requests, with attendant processing delays. Pending the hiring and training of additional staff to handle the influx of requests, the agency had decided to inform requesters by letter that delayed response was likely.

At the intervention of the Commissioner's Office, the agency mailed out copies of the complainants' credit histories, but the complainants did not receive them. Investigation revealed that the envelope had been returned to the agency and placed on file, probably because the complainants' apartment number had been omitted from the address label. The agency generated new credit reports and sent them to the correct address, complete with apartment number, as the complainants had clearly indicated in their request. In the last week of March, they finally received the information they had requested.

The agency has taken steps, notably the hiring of extra staff, to clear the backlog of requests and deal more expeditiously in future with what appear to be constant increases in volume. Since February 2002 the agency has been responding to access requests within eight days on average. As a result of the complainants' case in particular, the agency has also recognized the need for examining returned correspondence to determine the reason for any delivery failure. In future, the label address on returned correspondence will be checked for errors against the address in the originating request as well as the address in the requester's credit file itself.

Commissioner's Findings

Issued July 3, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business and also to any provincially regulated organization that discloses personal information for consideration outside the province. The Commissioner has jurisdiction in cases where the credit reporting agency in question, though provincially regulated, discloses personal information to clients across borders for consideration.

Application: Principle 4.9, Schedule 1, states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and given access to that information; and that the individual must be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization must respond to a request with due diligence and in any case not later than 30 days after receiving it. Section 8(5) states that an organization failing to respond to a request within the time limit is deemed to have refused the request.

The agency did not dispute that it had failed to provide the complainants with their requested personal information within the 30-day time limit set out in section 8(3) of the Act. The Commissioner determined specifically that the agency had not provided them with their credit reports until 117 days after receiving their requests and only after his Office had intervened to ensure that the information was accurately addressed and delivered to their residence. He found therefore that the agency had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused the requests, and had been in contravention of Principle 4.9 of Schedule 1.

Nevertheless, he was pleased to note that the complainants received their information and that the agency had taken what appeared to be appropriate remedial action to ensure compliance with section 8(3) of the Act in responding to future access requests.

The Commissioner concluded that the complaints were well-founded and resolved.