Individual complains of delayed response to credit history request and refusal to amend personal information
PIPEDA Case Summary #2003-124
[Principle 4.9, Principle 4.9.5, Schedule 1; sections 8(3), 8(5)]
An individual complained firstly, that a credit reporting agency had failed to respond to his request to give him access to his personal credit history and, secondly, that the company had refused to amend certain information contained in his credit report.
Summary of Investigation
In late July the individual wrote to the company, requesting a copy of his personal credit history. The company advised him that, before his personal information could be released to him, he had to provide proper and valid identification. Over a period of several weeks, the individual corresponded with the company until the company was satisfied that he had supplied sufficient identification.
The company subsequently sent him two undated letters of acknowledgement, stating that, although his request would be processed in order of receipt and with best efforts at timeliness, it could not be processed within the 30-day time limit set out in the Act because of an increased volume of requests at the time.
In late November when the individual had still not received his personal information, he phoned the company and obtained a verbal disclosure of his personal credit history. At that time, the company advised him that a copy of his information would soon follow.
When the individual still had not received his personal information in late December, he again wrote to the company, indicating that he had been waiting for his information for more than six months. He received his personal information in early January.
It was the company's position that late December should have been taken to be the effective date of the individual's request, as up to that point, the individual had still not supplied sufficient information to prove his identity. In the company's view, the period from late November to late December should therefore not be considered in tallying the response time. By this account, the company suggested that it had responded to the individual's request within a week - which is well within the limit prescribed in the Act.
However, the investigation confirmed that the individual did receive a verbal disclosure of his file over the phone in November, which indicated that the company was both satisfied as to the individual's identity and that it was aware of his access request at that time.
Regarding the individual's second complaint, after reviewing his personal information, the individual sent a request to the company, asking that it delete a particular entry in his credit report, which he considered inaccurate. The investigation revealed that the entry in question was in fact accurate and, when this was relayed to the individual, he felt that the matter was resolved.
Issued March 3, 2003
Jurisdiction: As of January 1, 2001 the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business and also to any provincially regulated organization that discloses personal information to creditor granters across borders for consideration. The Commissioner has jurisdiction in this case because the credit reporting agency, though provincially regulated, discloses personal information to clients across borders for consideration.
Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Principle 4.9.5 states that when an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Section 8(3) states that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if the organization fails to respond within the time limit, the organization is deemed to have refused the request.
With respect to the individual's first complaint, the Commissioner determined that, from late November, when the company verbally discussed his credit history, until January, when he received his personal information, 44 days had passed. He found therefore that the company had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused his request, and was, therefore, in contravention of Principle 4.9 of Schedule 1.
The Commissioner concluded that the first complaint was well-founded.
With respect to the individual's second complaint, the Commissioner was satisfied that, as his personal information was accurate and complete, there was no requirement for the company to amend his file. He found therefore that the company was not in contravention of Principle 4.9.5
The Commissioner concluded that the second complaint was not well-founded.
Report a problem or mistake on this page
- Date modified: