Cable provider accused of collecting excessive personal information as a condition of service
PIPEDA Case Summary #2003-152
[Principles 4.2.3, 4.3.2, 4.3.3 of Schedule 1; section 5(3)]
An individual complained when, in the course of disconnecting his cable service, the cable company representative asked for his date of birth and his mother's maiden name. He was also queried about his reasons for changing cable providers, as well as his new address.
Summary of Investigation
According to the complainant, the company representative indicated that his date of birth and mother's maiden name were required for identification purposes, and that if he refused to provide this information, the company would not disconnect the service. In response to his question about the company's need to know why he was disconnecting the service and what his new address was, he was told that it was required to "fill in the screen."
The company confirmed that it asks new subscribers for their date of birth and mother's maiden name for client identification purposes. However, in this case, the complainant did not provide this information when he originally signed up for the service, and therefore the company did not have this data in its database. Furthermore, since he was terminating his service, the company admitted that it should have used the information he had provided when he originally signed up for service.
The company considered the reason for terminating the service to be customer service related, and not personal, information. As for the customer's new address, the company viewed this information as necessary to ensure final payment or reimbursement to the customer. The company stated that responding to these questions was optional, but admitted that its representative neglected to distinguish between what information was required and what was not. The company also agreed that "filling in the screen" was not a valid reason for collecting a customer's personal information.
Issued April 14, 2003
Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking or business as defined in the Act.
Application: Principle 4.2.3 states that the identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected. Depending on the way in which the information is collected, this can be done orally or in writing. An application form, for example, may give notice of the purposes. Principle 4.3.2 specifies that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed. Principle 4.3.3 stipulates that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes. Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.
Although the company representative had informed the complainant of the reason for asking for his date of birth and mother's maiden name, the company admitted that it should have asked for the information he had previously provided since he was terminating the service. Thus, the Commissioner found that the collection of this information did not meet the expectations of Principle 4.3.3 and section 5(3) because it was not appropriate in these circumstances to collect this information, which was not necessary to obtain the requested service.
The Commissioner considered the reason for terminating service to be personal information for the purposes of the Act. He was of the opinion that a reasonable person would view the purposes for collecting this information, as well as the new address, to be legitimate and in accordance with section 5(3) and the collection of such information, in accordance with Principle 4.3.3. However, in this case, the complainant was not informed of the true reasons for requesting this information or that he was not, in fact, required to answer. Rather, he was told that it was needed to "fill in the screen." While the purpose for collecting this information may be appropriate in principle, the Commissioner found that, in this instance, the company contravened Principles 4.2.3 and 4.3.2 because it failed to inform the complainant, at the time of collection, of the true purposes for which this information was being collected, and thus did not obtain his valid consent.
The Commissioner concluded that the complaint was well-founded.
The Commissioner was pleased that the company brought this complaint to the attention of its client service representatives with a view to preventing such an incident from happening again.
Report a problem or mistake on this page
- Date modified: