Individual questions use of personal information by credit bureaus

PIPEDA Case Summary #2003-171

[Principle 4.5, 4.8, Schedule 1, section 5(3)]

Complaint

An individual complained that two credit bureaus improperly use the number of credit inquiries on consumers' credit bureau reports, without their knowledge and for a purpose to which they did not consent.

Summary of Investigation

The complainant contended that the credit bureaus use the number of credit inquiries on an individual's credit bureau report to assess their credit worthiness, and that each time a credit check is undertaken, the individual's credit rating is negatively impacted - regardless of his or her credit history. He also claimed that the credit bureaus do not obtain an individual's consent to use his or her personal information for this purpose.

Credit grantors frequently use credit scores provided by credit bureaus to determine whether or not to extend credit to an individual. Credit scoring is an automated method of assessing an individual's likelihood of repaying debt on time.

It is the position of both credit bureaus that credit inquiries are a proven predictor of credit risk and that, in general, the higher the number of inquiries, the greater the credit risk. Removing the number of inquiries as a factor used in determining a credit score would impair the ability of lenders to evaluate risk, leading to higher costs for consumers. The companies pointed out that the number of credit inquiries on an individual's credit bureau report is just one of several factors used to calculate a credit score, and that an individual's own inquiries are not used in that calculation. Furthermore, the scoring model ignores all mortgage and automobile loan inquiries within 30 days prior to the calculation of a score and treats any number of mortgage and automobile loan inquiries within any 14 day period as a single inquiry.

The companies also took the position that credit granting agencies do in fact obtain the consent of consumers to use the number of credit inquiries to calculate their credit score and assess their credit worthiness. While the actual wording of the consent clauses varies from agency to agency, credit grantors typically ask customers to consent to the disclosure of their personal information to a credit bureau, and also advise them that this information will be used to assess their credit application. As well, the companies stated that they have standard contracts with credit granting agencies, which include clauses that guarantee the credit grantors have obtained a customer's consent to use and disclose his or her personal information.

Lastly, the companies claimed that they have made credit scoring information and the factors used to create a credit score readily available to consumers. This information is published on the companies' Web sites and can be obtained by contacting one of the companies' customer service centres.

Commissioner's Findings

Issued April 25, 2003

Jurisdiction: As of January 1, 2002, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business and also to any disclosure of personal information by an organization outside the province for consideration. The Commissioner has jurisdiction in these cases because credit reporting agencies disclose personal information to grantors across borders for consideration.

Application: Principle 4.5 states that personal information shall not be used or disclosed for purposes other than those for which is was collected, except with the consent of the individual or as required by law. Principle 4.8 states that an organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information. Section 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

The Commissioner determined that the credit bureaus do obtain the consent of consumers, through credit granting agencies, to use their personal information in a credit application, and by implication, the fact of the application itself, to assess their credit worthiness, which is consistent with Principle 4.5. He also determined that the companies do make their practices related to credit scoring and the use of that information available to consumers. He found therefore that the companies were in compliance with Principle 4.8.

Lastly, the Commissioner was of the view that a reasonable person would consider the purpose for using the number of credit inquiries to assess an individual's credit worthiness to be entirely appropriate, particularly since it is only one of several factors used to calculate a credit score. He therefore found the companies were also in compliance with section 5(3).

The Commissioner concluded that the complaints were not well-founded.