Telecommunications company accused of using customer's personal information without consent
PIPEDA Case Summary #2003-126
[Principle 4.3; section 5(3)]
The complainant alleged that her cable provider retrieved her home address from her account file in order to respond in writing to complaints she had made by telephone and e-mail.
Summary of Investigation
An individual contacted her cable provider a number of times by telephone and e-mail to voice her concerns regarding a programming issue. The cable company responded by writing to her home address. The complainant stated that, in her messages to the company, she had never provided her home address, and that the company must have checked her cable account to retrieve it. In her view, she had provided her address only for the purpose of receiving cable service.
The company did not deny obtaining the complainant's address from her account. It maintained, however, that it had her consent to do so by virtue of a clause contained in an invoice that each customer receives. The clause indicates that the company may occasionally disclose customer personal information for the purpose of, among other things, responding to customer questions. Since it was responding to the complainant's questions, thus meeting one of the conditions in the clause, the company maintained that it had the right to obtain the complainant's home address from her account. While the complainant agreed that, based on this clause, the company was entitled to use her personal information for the purpose of addressing her concerns, she maintained that it should have responded to her by telephone or e-mail.
Issued March 4, 2003
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking, or business as defined in the Act.
Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
The Commissioner found that the company clearly had the complainant's consent to use her personal information to respond to her questions and was therefore in compliance with Principle 4.3.
He also found it appropriate for the company, in its efforts to respond to her concerns, to access her account in order to obtain her address. He thus found the company's purpose for using the complainant's personal information to be appropriate in the circumstances and therefore in compliance with section 5(3).
The Commissioner concluded that the complaint was not well-founded.
Report a problem or mistake on this page
- Date modified: