Customer alleges company used his phone records to trace debtor

PIPEDA Case Summary #2002-61

[Principles 4.3, 4.3.2, and 4.5, Schedule 1; and section 5(3)]

Complaint

An individual complained that his telephone company had improperly used his personal information, specifically his long-distance telephone records, without his knowledge and consent, for the purpose of tracking down a third-party debtor.

Summary of Investigation

The complainant's sister-in-law had given the company his telephone number as a contact when she had her own telephone disconnected in preparation for a move. When the sister-in-law did not pay her final bill, the company made inquiries and eventually learned that she had left the country to live in a certain city in the United States. The company then examined the complainant's long-distance telephone records and noticed several calls made to a number in that city. The company called the number, reached the sister-in-law, and spoke to her about her outstanding account.

The company's position was that this use of the complainant's records was consistent both with the Personal Information Protection and Electronic Documents Act and with the company's own privacy code. One clause of that code stated that customers' use of products or services constitutes implied consent for collection, use, and disclosure of personal information "for all identified purposes". Another clause sets out several broad purposes for the company's collection of customers' personal information, without ascribing these purposes to any specific acts or types of collection. The company maintained that using a customer's phone records to locate a debtor who had provided that customer's telephone number as a contact was consistent with two of the broadly stated purposes.

The company also invoked section 5(3) of the Act to argue that a reasonable person would have considered its use of the complainant's long-distance records appropriate in the circumstances. The company maintained that it was both reasonable and appropriate for an organization to use all legal means at its disposal to collect on a debt. The company also suggested that finding otherwise would not be in the public interest, in that it would affect the company's ability to collect on outstanding debts, would support the ability of customers to avoid payment and evade collection, would substantially increase the costs of providing telephone services, and in turn would necessitate an equivalent increase in the rates charged to all telephone subscribers.

Commissioner's Findings

Issued July 19, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because telecommunications companies are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2 states that organizations must make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used; for consent to be meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. Principle 4.5 states that personal information must not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

On the matter of consent, the Commissioner was especially mindful of the requirement for the complainant's knowledge under Principles 4.3 and 4.3.2. In general, he considered whether the purpose clause and consent clause in the company's code provided a legitimate basis for knowledge and consent on the complainant's part. In particular, he considered whether the complainant could reasonably have known that his long-distance records would be used for the purpose of tracking down a third-party debtor. The Commissioner determined as follows:

  • On reading the purpose clause of the company's privacy code, the complainant would not have been reasonably able to understand, from the manner in which purposes were stated, that the company intended to use his personal telephone records to track down a third party who owed the company money; that the two broad purposes cited as relevant might one day reduce to using one customer's personal information to obtain personal information about another; or that such purposes would ever be cited to justify using his personal phone records to track down his sister-in-law over a matter of debt in which he was in no way implicated.
  • The company's broad and unascribed statements of purpose were not a reasonable way of informing the complainant how his telephone records would actually be used.
  • The company had not made a reasonable effort to advise the complainant, in an understandable manner, of the purposes for which his telephone records would be used, notably the purpose of tracking-down third-party debtors

The Commissioner found therefore that the company had not been in compliance with Principle 4.3.2. It followed that the purpose clause and consent clause of the company's code had not sufficed as a basis for the complainant's knowledge and consent. The Commissioner thus found that the company had also been in contravention of Principle 4.3.

Regarding Principle 4.5, the Commissioner noted that this provision could have little force or meaning unless purposes themselves were limited. If purposes for collection were vaguely formulated, there was no possibility of limiting use and disclosure accordingly. He determined as follows:

  • The purposes cited as relevant by the company were so vaguely formulated as to preclude virtually any limitation of use and disclosure. It was difficult to imagine any use or disclosure, legitimate or otherwise, that could not be rationalized under such formulations.
  • It is was not reasonable to put a customer in the position of having to guess what range of specific practices may be contemplated under such seemingly open-ended categories.
  • Since the complainant had no reasonable way of knowing the company's specific purposes for collecting specific types of personal information such as long-distance telephone records, the company could in no meaningful way be said to have limited its use of the complainant's records to the purposes for which they were collected.

The Commissioner found therefore that the company had also been in contravention of Principle 4.5.

He then addressed the question whether the company could bring itself into compliance with the Act simply by better explaining the practice to its customers, or whether the practice was problematic in itself. Specifically, he considered the company's arguments in reference to section 5(3), the "reasonable person" provision. He deliberated as follows:

  • A reasonable person would be likely to take a broader view of the public interest than the company had suggested. It would be a view not preoccupied with telephone rates and debt collection, but would encompass other considerations such as due respect for the privacy of personal information.
  • A reasonable person would not consider the company's pursuit of a debtor to be an appropriate use of the personal information of another individual.
  • Even if the individual was duly notified of the specific purpose in advance, a reasonable person would not consider it an appropriate purpose in keeping with the spirit of the Act.

The Commissioner found that, regardless of whether the purpose was properly identified, the company was in contravention of section 5(3).

He concluded that the complaint was well-founded.

Further Considerations

The Commissioner recommended that the company immediately cease its practice of using customers' telephone records to obtain information about other individuals.

Date modified: