Couple objects to agency's delayed response to requests for credit histories

PIPEDA Case Summary #2002-64

[Principles 4.9, Schedule 1; and sections 8(3) and 8(5)]


A husband and wife complained that a credit reporting agency had failed to respond to their requests for access to their personal credit histories.

Summary of Investigation

The complainants made written requests for copies of their credit histories on November 30, 2001. On January 13, 2002 the complainants sent an e-mail to the agency inquiring about the status of their requests. The only response they received was an electronic message informing them how to make application for their personal information, which they had already done. When the complainants still had not received their credit reports by mid-January, they filed their complaints with the Commissioner's Office.

Investigation revealed that the agency did receive the complainants' requests for their credit history and updated their files at that time. However, the copies that were to have been forwarded to them were inadvertently left on their files and not mailed. The Commissioner was satisfied that the failure to respond to the complainants' requests was the result of human error, not a system or policy error.

At the intervention of the Commissioner's Office, the agency mailed out the copies to the complainants who confirmed they have received their information.

Commissioner's Findings

Issued July 29, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business and also to any provincially regulated organization that discloses personal information for consideration outside the province. The Commissioner has jurisdiction in cases where the credit reporting agency in question, though provincially regulated, discloses personal information to clients across borders for consideration.

Application: Principle 4.9, Schedule 1, states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and given access to that information; and that the individual must be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization must respond to a request with due diligence and in any case not later than 30 days after receiving it. Section 8(5) states that an organization failing to respond to a request within the time limit is deemed to have refused the request.

The agency did not dispute that it had failed to provide the complainants with their requested personal information within the 30-day time limit set out in section 8(3) of the Act. The Commissioner determined specifically that the agency had not provided them with their credit reports after receiving their requests and only after his Office had intervened to ensure that the information was delivered to their residence. He found therefore that the agency had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused the requests, and had been in contravention of Principle 4.9 of Schedule 1.

The Commissioner concluded that the complaints were well-founded and resolved.

Date modified: