Telecommunications company used and disclosed customer's personal information

PIPEDA Case Summary #2003-210

[Principles 4.3 and 4.5 of Schedule 1]

Complaint

An individual complained that his telephone company disclosed his personal information when a representative called his parents, informed them that he was moving and tried to obtain details about the move.

Summary of Investigation

In 2002, the complainant changed residences. Before he notified his telephone company about the impending move, the company received a connection request from the individual who was going to move into his residence. The company therefore required information from the complainant regarding the disconnection of his service.

The complainant stated that, to his knowledge, the company did not make any attempt to contact him at home or at work. The complainant's mother, however, received a call from a woman who identified herself as a representative of the telephone company. The employee did not state that she had attempted to contact the complainant, nor did she give the complainant's mother a message to relay to him. Instead, she asked if the mother knew the son was moving and, if so, where and when. The mother indicated her discomfort to the employee about these questions and declined to respond.

The company's records showed that when the complainant initially subscribed for service, he provided his parents' names, his relationship to them and their telephone number as a reference during the credit application process. According to the company, this information is to be used only if the company is unable to contact the subscriber. In such a case, a company representative would leave a message with the reference for the subscriber to contact the company.

The company only retains records involving connection or disconnection of service, including any notes or comments regarding such transactions, for three months. It was therefore not able to confirm how many attempts, if any, were made to communicate with the complainant. While the company does not have any guidelines specifying the number of times its representatives must use the primary contact number to reach a subscriber before resorting to the reference, it indicated that its representatives prefer to use the primary contact number since it enables a direct conversation with the subscriber or at least a recorded message. By contacting the reference number, additional calls are required and the matter generally takes longer to resolve.

Commissioner's Findings

Issued August 1, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.5 establishes that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

The company collected the complainant's personal information, namely, his contact information, for the purpose of leaving a message for him in case the company needed to communicate with him and could not reach him at home or at work. In this case, however, the Commissioner determined that the company did more than simply leave a message. It used the complainant's personal information and then disclosed more of his personal information to his reference, namely, the fact that he was moving, without his knowledge and consent. He therefore found the company in contravention of Principles 4.3 and 4.5 of Schedule 1.

The Commissioner concluded that the complaint was well-founded.

Further Considerations

The company confirmed that, at the complainant's request, it had removed his parents' names and telephone number, as well as his Social Insurance Number, from his account profile.