Language selection


Credit bureaus exceed time limits for access requests, but amend inaccurate information

PIPEDA Case Summary #2003-187

[Principles 4.9, 4.9.5, 4.9.6; sections 8(3) and 8(5)]


An individual filed a total of four complaints against two credit bureaus. Specifically, she accused each organization of (1) failing to provide her with a copy of her credit file within the time limit prescribed under the Personal Information Protection and Electronic Documents Act (the Act); and (2) refusing to correct information that she believed was incorrect.

Summary of Investigation

Both credit bureaus took longer than 30 days to respond to the complainant's requests. As for her accuracy challenges, both bureaus updated items that were shown to be inaccurate and forwarded an amended credit report to those organizations that had made inquiries on her file.

The complainant initially objected to two R9 ratings that she had. However, her concerns were largely the result of a misunderstanding of how the credit reporting system worked. While she would have preferred to have had these ratings removed, she subsequently stated that she understood that they were correct and that they would be removed after the provincially legislated time frame of six years. She wrote a statement regarding these ratings, which both credit bureaus attached to her file and transmitted to third parties that had access to her information.

Commissioner's Findings

Issued July 10, 2003

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business and also to any disclosure of personal information by an organization outside the province for consideration. The Commissioner has jurisdiction in these cases because credit bureaus disclose personal information across borders for consideration.

Application: Principle 4.9 states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and given access to that information; and that the individual must be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization must respond to a request with due diligence and in any case not later than 30 days after receiving it. Section 8(5) states that an organization failing to respond to a request within the time limit is deemed to have refused the request.

Principle 4.9.5 states that when an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question. Principle 4.9.6 establishes that when a challenge is not resolved to the satisfaction of the individual, the substance of the unresolved challenge shall be recorded by the organization. When appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.

Neither agency disputed that it had failed to provide the complainant with her requested personal information within the 30-day time limit set out in section 8(3) of the Act. The Commissioner found therefore that both organizations had not met their obligations under section 8(3), were thus deemed under section 8(5) to have refused the requests, and had been in contravention of Principle 4.9 of Schedule 1.

The Commissioner concluded that these two complaints were well-founded.

With respect to the other two complaints, the Commissioner was satisfied that the organizations acted appropriately in response to the complainant's accuracy challenges. Both investigated her concerns, amended inaccurate information, and provided her, as well as all the organizations that had made an inquiry on her file, with an amended credit report, as per their obligations under Principle 4.9.5. As for the R9 ratings, the complainant asked both credit bureaus to include a statement regarding them, which they did, in accordance with Principle 4.9.6.

The Commissioner concluded that these complaints were not well-founded.

Report a problem or mistake on this page
Error 1: No selection was made. You must choose at least 1 answer.
Please select all that apply (required):


Date modified: