Several complaints about agency's delayed response to requests for credit histories

PIPEDA Case Summary #2002-67

[Principles 4.9, Schedule 1; and sections 8(3) and 8(5)]

Complaint

Several parties complained that a credit reporting agency had failed to respond to their requests for access to their personal credit histories.

Summary of Investigation

The complainants had all requested copies of their personal credit histories in November and December 2001. In each case, the credit reporting agency in question sent a letter of acknowledgment stating that the requests could not be processed within 30 days because of increased volume at the time. This letter also notified the requesters of their right to complain under the Personal Information Protection and Electronic Documents Act. When the requesters still had not received their credit reports after several weeks, they filed their complaints with the Commissioner's Office.

The agency had indeed been experiencing a significant increase in the volume of access requests, with attendant processing delays. Pending the hiring and training of additional staff to handle the influx of requests, the agency had decided to inform requesters by letter that delayed response was likely.

At the intervention of the Commissioner's Office, the agency sent the complainants copies of their credit histories. All eventually confirmed receipt of the personal information they had requested. The agency has taken steps, notably the hiring of extra staff, to clear the backlog of requests and deal more expeditiously in future with what appear to be constant increases in volume. Since February 2002 the agency has been responding to access requests within eight days on average.

Commissioner's Findings

Issued August 28, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business and also to any provincially regulated organization that discloses personal information for consideration outside the province. The Commissioner has jurisdiction in cases where the credit reporting agency in question, though provincially regulated, discloses personal information to clients across borders for consideration.

Application: Principle 4.9, Schedule 1, states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and given access to that information; and that the individual must be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization must respond to a request with due diligence and in any case not later than 30 days after receiving it. Section 8(5) states that an organization failing to respond to a request within the time limit is deemed to have refused the request.

The agency did not dispute that it had failed to provide the complainants with their requested personal information within the 30-day time limit set out in section 8(3) of the Act. In each case, the Commissioner determined that the requested information had been provided well beyond the time limit and only after intervention by his Office. He found therefore that the agency had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused the requests, and had therefore been in contravention of Principle 4.9 of Schedule 1.

Nevertheless, he was pleased to note that the complainants had at last received their information and that the agency had taken what appeared to be appropriate remedial action to ensure compliance with section 8(3) of the Act in responding to future access requests.

The Commissioner concluded that the complaints were well-founded and resolved.

Date modified: