Law firms collected credit reports without consent

PIPEDA Case Summary #2006-340

(Paragraphs 4(1)(a) and 13(2)(b); Principle 4.3 of Schedule 1; and paragraph 7(1)(b))

The Office of the Privacy Commissioner of Canada (OPC) received two complaints from individuals alleging that different law firms had collected their personal information, by conducting credit checks on them, without their knowledge or consent. The issue of jurisdiction was raised during the investigations, though in different ways. The Assistant Privacy Commissioner concluded that both cases were well-founded.

At first, neither law firm implemented the Commissioner’s recommendation and the matter was referred to the Commissioner’s litigation counsel. Shortly after being contacted by the Commissioner’s counsel, both law firms agreed to implement the recommendations thus avoiding the need to follow through with an Application in the Federal Court.

The following is a summary of each complaint and investigation.

Complaint A

An individual complained that a law firm collected his personal information, by conducting a credit bureau inquiry, without his knowledge and consent.

Summary of Investigation

The law firm confirmed that it did conduct the credit inquiry. It argued, however, that the OPC did not have jurisdiction in this matter, as the information was collected for personal purposes of a client in relation to possible litigation, and it would therefore not provide the Office with access to its records.

The Office asserted its jurisdiction with respect to the complaint on the basis that the collection occurred during the course of the law firm’s commercial activities.

The complainant had also filed a complaint with the credit bureau regarding the collection of his credit information. The credit bureau requires its member companies, such as the law firm in this case, to obtain express consent for the collection of credit information. Since the law firm failed to provide adequate information or cooperate fully with the credit bureau’s inquiries, the credit bureau concluded that the law firm did not have the complainant’s consent to the collection. As a result, the law firm’s membership privileges were suspended.

Findings

Issued May 2, 2006

Application: Paragraph 4(1)(a) establishes that Part I of the Act applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

The Assistant Commissioner was satisfied that the collection occurred in the course of the firm’s commercial activities, and noted that as there was no general exclusion for the activities of law firms undertaken on behalf of their clients. The Office therefore found that it had jurisdiction in the matter, pursuant to paragraph 4(1)(a).

As for the collection, the law firm admitted that it had collected the complainant’s personal information, by way of credit inquiry. The complainant had alleged that this was done without his consent, and the law firm did not provide any evidence to the contrary.

The Assistant Commissioner therefore concluded that the information was collected without the complainant’s knowledge or consent, in contravention of Principle 4.3. She recommended that the law firm implement a policy that prohibits conducting credit checks without the individual’s consent, unless one of the exceptions to the requirement for consent, as set out in the Act, is applicable. The law firm responded by continuing to challenge this Office’s jurisdiction, maintaining that the issue did not involve any commercial activity. It stated that it continues to comply with the Act, as it has since the Act came into force. It also maintained that it does not collect the personal information of anyone without their consent. The Assistant Commissioner was not satisfied with this response, noting that the Act requires organizations to be open about their privacy policies and practices. The response from the law firm did not address the specific recommendation of the Office to implement a policy for obtaining consent to conduct credit checks. Nor did the response provide any further evidence that the Act was not contravened in this instance.

Accordingly, she concluded that the complaint was well-founded.

Complaint B

An individual alleged that a lawyer improperly collected her and her husband’s personal information without their consent, when the lawyer accessed the couple’s credit files from a credit bureau.

Summary of Investigation

The complainant and her husband were involved in a legal dispute with clients of the law firm in question.  One of the lawyers from the firm obtained copies of the couple’s credit reports, and he subsequently provided copies of the reports to their own counsel. 

During the investigation, the complainant filed a complaint with the provincial ministry responsible for consumer reporting legislation.  The ministry looked into the matter, but informed her that it would not levy any fines against the law firm and so considered the matter closed.  The Office proceeded with its investigation.

The credit bureau indicated that the law firm is one of its members.  It was determined, however, that the firm did not follow proper procedures laid out in the membership agreement since the lawyer did not have the complainant’s consent.  As a result, the law firm’s membership privileges were suspended.

The law firm presented a number of arguments in support of its action.  It was of the view that it was reasonable in the circumstances to obtain the complainant’s credit report to determine whether it was worthwhile to continue to pursue a counterclaim in litigation against the complainant.  It also contended that one of the exceptions to consent applied in this situation, namely, paragraph 7(1)(b), which allows an organization to collect personal information without knowledge and consent if it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.  The law firm also challenged the Office’s jurisdiction, stating that the provincial government had jurisdiction to examine the complaint since the consumer reporting legislation deals exclusively with the obtaining of a credit report.

Findings

Issued May 2, 2006

Application: Paragraph 4(1)(a) establishes that Part I of the Act applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities.  Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.  Paragraph 7(1)(b) indicates that an organization may collect personal information without the knowledge or consent of the individual only if it is reasonable to expect that the collection with the knowledge or consent would compromise the availability or accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province. 

In making her determinations, the Assistant Commissioner deliberated as follows:

• The law firm contended that only the provincial government had jurisdiction to examine the complainant’s concerns since the provincial consumer reporting legislation deals exclusively with obtaining credit reports. 
• The Assistant Commissioner noted that under paragraph 13(2)(b) of the Act, the Assistant Commissioner may exercise her discretion to not prepare a report of findings on the basis that the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under the laws of a province. 
• However, the complainant filed a complaint with the appropriate provincial ministry, which looked into the complaint and considered the matter closed. 
• As the matter at issue concerned the complainant’s personal information, namely, her credit report, which was collected in the course of a commercial activity, the Assistant Commissioner was of the view that the Office had jurisdiction to investigate this matter and issue findings.
• She noted that Principle 4.3 requires consent and knowledge for the collection, use or disclosure of personal information, except in certain circumstances. 
• It was clear that the law firm did not have the consent of the complainant or her husband when it obtained their credit reports.  In her view, the law firm failed to make a compelling argument in support of obtaining such information without the appropriate consent, under paragraph 7(1)(b).  This information was not collected to investigate a breach of an agreement or a contravention of a law of Canada or a province, but rather to determine whether it was worthwhile to counterclaim against the complainant in litigation. 
• The Assistant Commissioner therefore determined that the law firm collected the complainant’s personal information without her knowledge and consent, in contravention of Principle 4.3.  The Assistant Commissioner recommended that the firm implement a policy that prohibits conducting credit checks without appropriate consent, unless for a permissible purpose.  The firm responded by refusing to accept the recommendation. 

Accordingly, the Assistant Commissioner concluded that the complaint was well-founded.

For both complaints the Assistant Commissioner also indicated that she would pursue the matter in accordance with the Act and referred the cases to her litigation counsel.  Shortly after being contacted by the Commissioner’s counsel, both law firms agreed to implement the recommendations thus avoiding the need to follow through with an Application in the Federal Court.