Individual refused access to credit history
PIPEDA Case Summary #2003-134
[Principle 4.9, Schedule 1, section 8(3), 8(5)]
An individual complained that a credit reporting agency had refused her access to her personal credit history.
Summary of Investigation
In February 2002, the complainant advised a credit reporting agency that an individual had attempted to use her personal information to obtain credit. As a result, the company placed a "fraud alert" on the complainant's file and directed her to request, in writing within a specified period of time, a copy of her credit history, the purpose of which was to ensure the fraudulent information had been removed from her file. The complainant complied, sending a letter to the company on February 22.
Several weeks later, the complainant sent an e-mail to the company, asking to be informed of the status of her request. The only reply she received was an electronic message, explaining how to apply for her personal information and requesting that she provide the appropriate identification, which she had already done.
Shortly thereafter, the complainant again wrote to the company and, when she still had not received a response by the first week of April, filed a complaint with the Commissioner's Office. The company sent the complainant a copy of her credit history in early May. After the complainant advised the company that her credit history contained errors, the report was corrected and an updated copy was sent to her.
The company explained that the complainant's request should have been sent to its fraud department. According to the company, its system is designed to ensure customers promptly receive a copy of their credit history upon request, and that the company's failure to do so in this case was the result of a human error.
Issued March 6, 2003
Jurisdiction: As of January 1, 2001 the Personal Information Protection and Electronic Documents Act applies to any federal work, business, or undertaking and also to any provincially regulated organization that discloses personal information for consideration outside the province. The Commissioner has jurisdiction in this case as the credit reporting agency in question, though provincially regulated, discloses personal information to clients across borders for consideration.
Application: Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information, shall be given access to that information, and shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization shall respond with due diligence and in any case not later than thirty days after receipt of the request. Section 8(5) states that if an organization fails to respond within the time limit, the organization is deemed to have refused the request.
The Commissioner determined that the company did not provide the complainant with her credit history until 69 days after receiving her request and only after she had filed a complaint with the Commissioner's Office. He found, therefore, that the company had not met its obligation under section 8(3), and was thus deemed under section 8(5) to have refused the request in contravention of Principle 4.9. Nevertheless, the Commissioner was pleased to note that the complainant had received her personal information and that the corrections she had asked for had been made.
The Commissioner concluded that the complaint was well-founded.
Report a problem or mistake on this page
- Date modified: