Credit reporting agency accused of inappropriately expunging positive credit history

PIPEDA Case Summary #2003-157

[Principles 4.5, 4.5.2, 4.9, Schedule 1; and sections 8(3) and 8(5)]

Complaint

An individual complained that a credit reporting agency
(1) had failed to give him timely access to personal information he had requested;
(2) had inappropriately destroyed personal information about him that should have been kept on file; and
(3) was not intending to use his personal information, specifically a narrative statement on his credit history, to his best advantage.

Summary of Investigation

In the course of a dispute with the agency over the accuracy of his current credit ratings, the complainant made a detailed request for personal information pertaining to his credit file. In a response letter, the agency dealt at length with the subject matter of the dispute, but made no mention of the access request. The complainant sent two further letters of reminder. Sixty-seven days after the date of his request, the agency sent him only his credit file, with an explanation that other types of information requested had not been retrievable.

The Commissioner's Office confirmed that the agency did not have most of the types of records requested. However, the complainant had previously made requests for amendments to his credit file, and provincial legislation required the agency to keep notations of such requests. On being informed of its obligation under the Personal Information Protection and Electronic Documents Act to provide the complainant with copies of any filed correspondence relating to requested amendments, the agency agreed to do so and to bring its access policy into compliance with the Act. Nevertheless, it took almost 10 months for the agency to give the complainant all the information to which he was entitled.

The complainant also believed that it was wrong of the agency to have destroyed past records reflecting a more positive period in his credit history. The provincial consumer reporting legislation to which the agency is subject stipulates that six years is the maximum period in which "information adverse to a consumer's interest" may be retained on a credit report. Although the legislation does not prescribe either a maximum or a minimum retention period for information favourable to a consumer, the agency had adopted the six-year limit for both negative and positive credit ratings. The agency maintained that the six-year retention period accorded well with the company's primary purpose, which is to provide credit grantors with current information on the financial performance of a person seeking credit. The agency also pointed out that it did not have the business capacity to store voluminous records of the past credit performance of individuals.

As a compromise towards mitigating the effects of the complainant's negative credit ratings, the agency had proposed that his credit file be removed temporarily from its automated system and that the complainant attach a narrative statement to it, explaining the reasons for the ratings. Under this alternative arrangement, a credit grantor would receive only a hard copy of the complainant's credit file, including the narrative statement, but would not have the opportunity to obtain a credit score for him until the retention period for the current ratings had expired and his file returned to the automated system.

The complainant had declined to accept the agency's proposal, pending assurance that the narrative statement would be used as a factor in determining his credit score so as to offset the negative effects of the current credit ratings in dispute. The Commissioner's Office determined that this would not be the case, since the standardized credit scoring model used by the agency to generate credit scores relies upon current credit history and does not accommodate such information as would appear in a narrative statement.

Commissioner's Findings

Issued April 16, 2003

Jurisdiction: As of January 1, 2001, the Act applies not only to any federal work, undertaking, or business, but also to disclosures of personal information made by any organization across borders for consideration. The Commissioner had jurisdiction in this case because it was determined that the credit reporting agency did engage in such disclosures.

Application: Principle 4.5 states in part that personal information must be retained only as long as necessary for the fulfilment of the purposes for which it was collected. Principle 4.5.2 states in part that organizations should develop guidelines and implement procedures with respect to the retention of personal information and that such guidelines should include minimum and maximum retention periods. Principle 4.9 states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information, be given access to that information, and be able to challenge its accuracy and completeness and have it amended as appropriate. Section 8(3) states that an organization must respond to an access request with due diligence and in any case not later than 30 days after receipt. Section 8(5) states that an organization failing to respond within the time limit is deemed to have refused the request.

Regarding the first complaint, the Commissioner determined that 67 days had elapsed between the date of the initial access request and the date on which the agency sent the credit file - a period well in excess of the prescribed 30-day time limit. He noted also that the agency had not given formal notice of any need for an extension of the time limit and had withheld some of the information for almost 10 months. He found therefore that the agency had clearly not met its obligations under section 8(3) of the Act and was thus deemed under section 8(5) to have initially refused the complainant's request in contravention of Principle 4.9 of Schedule 1. Nevertheless, he was satisfied that the agency had eventually provided the complainant with all retrievable information to which he was entitled.

He concluded that the first complaint was well-founded and resolved.

Regarding the second complaint, the Commissioner first pointed out that the Act itself did not presume to set out specific minimum or maximum periods for the retention of personal information; rather, each organization was expected to set its own retention policy, provided only that such policy be based on the principle that personal information must be kept on file just long enough to serve its purpose. He accepted the premise that the agency's essential purpose was to provide credit grantors with current information on the financial performance of credit applicants. He was satisfied that the six-year retention period adopted by the agency in observance of provincial legislation was adequate for the fulfilment of that purpose. He was also satisfied that the company did have in place appropriate guidelines and procedures regarding the retention of personal information. He found therefore that the agency was in compliance with Principles 4.5 and 4.5.2.

He concluded that the second complaint was not well-founded.

Regarding the third complaint, the Commissioner determined that a narrative statement attached to a credit file would not be conducive to the result that the complainant most desired - a more positive credit score. In terms of the Act, however, the Commissioner was obliged to concern himself not with what might be most desirable to either party in a complaint, but rather with what was appropriate and reasonable. He observed that, although the proposed alternative method of managing the complainant's credit file would have no effect on the credit score, it would have the effect of obviating reference to a credit score and compelling a credit grantor to consider the complainant's side of the story in assessing his credit worthiness. In the Commissioner's view, this proposal was entirely appropriate and reasonable - a genuine attempt on the agency's part to treat the complainant as fairly as possible in the circumstances. In any event, the Commissioner could find nothing in it that offended the Act.

He concluded that the third complaint was not well-founded.

Date modified: