Investigation into Bell’s compliance with PIPEDA when responding to an access request for personal information

PIPEDA Findings #2026-003

January 9, 2026

---

Introduction

1. The Complainant alleged that Bell Canada (“Bell”) contravened the Personal Information Protection and Electronic Documents Act (“PIPEDA” or the “Act”) when it did not respond to his access request within the prescribed 30 days and then denied him access to his cellphone logs. Bell explained that to provide the Complainant access to the logs, it would require the consent of the “account holder.”
2. The Complainant and his ex-spouse shared an account with Virgin Mobile Plus, a subsidiary of Bell, for their respective cellphone lines. Following the relationship’s dissolution, the Complainant switched to a different carrier for his phoneline, while the ex-spouse remained on the Bell account for her phoneline. The Complainant submitted an access request to Bell for the phone logs of his phoneline, for a period in which Bell was his carrier.
3. First, our Office found that Bell contravened subsection 8(3) of PIPEDA when it took longer than 30 days to respond to the Complainant’s access request and did not request an extension of time to respond. Bell informed us that administrative confusion had caused its delay in responding to the Complainant’s request.
4. Second, our Office found that Bell also contravened Principle 4.9 of Schedule 1 of PIPEDA by denying the Complainant access to his phone logs. We determined that the phone logs relating to the Complainant’s phoneline were the Complainant’s personal information. While this information may have also been the ex-spouse’s personal information by virtue of her being the account holder, we determined that the Complainant had a greater privacy interest in the information about his phoneline and that there was a public interest in disclosure, such that Bell should have given him access to the phone logs. Moreover, because the phone logs contained some information belonging to the account holder only (i.e., general account information), Bell should have provided the phone logs to the Complainant with appropriate redactions.
5. Finally, during the course of our investigation, we noted that Bell was not sufficiently open with individuals about the fact that account holders have access to the phone usage details of any owner and user of a phoneline connected to the account (including the communication format, phone numbers that were called, and call time and duration), contrary to PIPEDA’s Openness principle.
6. Therefore, by taking longer than 30 days to respond to the Complainant’s access request, then denying him access to his phone logs, Bell contravened PIPEDA such that we find both aspects of the complaint to be well-founded.
7. Given the PIPEDA contraventions identified, and with a view to enhancing Bell’s internal procedures—so that it can appropriately respond to access requests for shared accounts and prevent similar issues in the context of personal cellphone lines on shared plans—we made several recommendations to Bell. Bell ultimately agreed during our investigation to provide the Complainant with the phone logs that he had requested, and we thus find this aspect of the complaint to be resolved. In addition, because Bell committed to implementing our recommendations to better enable individuals to access their personal information on their phonelines and updating their privacy policy and FAQ to make clearer what the account holder can access, we consider both these aspects conditionally resolved.

Background and Complaint

8. The Complainant and his ex-spouse shared an account with Virgin Mobile Plus, a subsidiary of Bell, for their respective cellphone lines. The Complainant’s ex-spouse was the “account holder” on the account, while the Complainant was an “authorized user.”
9. Following the relationship’s dissolution and with the Complainant’s agreement, the ex-spouse removed the Complainant as an authorized user from the account. The Complainant switched to a different carrier for his phoneline, while the ex-spouse remained on the Bell account for her phoneline.
10. Two years after having been removed from the account, the Complainant submitted an access request under PIPEDA to Bell for the call and text message log records of his phoneline for the period in which he was an authorized user on the account.
11. A few days later, Bell acknowledged receipt of the Complainant’s access request. Two months after the request, Bell informed the Complainant that it would not provide the requested records without the written consent of the account holder (i.e., the Complainant’s ex-spouse).
12. Unsatisfied with Bell’s response, the Complainant filed a complaint with our Office regarding his access request, noting that he should not require the ex-spouse’s permission to access his personal information.

Analysis

Issue 1: Did Bell respond to the Complainant’s access request within thirty days?

13. Subsection 8(3) of PIPEDA states that an organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request.
14. Subsection 8(4) provides that the organization may extend this time limit for up to thirty days in certain specified circumstances. To avail itself of such an extension, the organization must, no later than thirty days after the date of the request, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit, and of their right to make a complaint to the Commissioner in respect of the extension.
15. Bell acknowledged the Complainant’s access request within two days of receiving it. However, it did not respond to the request within thirty days, nor did it send the Complainant a notice of extension. Ultimately, Bell responded to the request approximately two months after receiving it.
16. Bell explained to our Office that it had “no excuse” for the delay in responding to the Complainant’s access request. It stated that the error resulted from administrative confusion because the Complainant had sent another similar request from a different email address.
17. We therefore find that Bell contravened subsection 8(3) of PIPEDA.

Issue 2: Did Bell adequately respond to the Complainant’s request to access his personal information?

18. For the reasons explained below, we find that Bell did not adequately respond to the Complainant’s request to access his cellphone logs.
19. Principle 4.9 of PIPEDA states, in part, that upon request, an individual shall be informed of the existence, use, and disclosure of their personal information and shall be given access to that information.

Bell’s Representations and Account System

20. Bell represented to our Office that it had adequately responded to the Complainant’s access request since, in its view, the information held in a client’s account (including the phone logs requested by the Complainant) is only the account holder’s personal information, and therefore not the Complainant’s personal information.
21. Bell explained to our Office that when responding to the Complainant’s access request, it determined that he was not the account holder for the account to which the relevant phoneline was previously attached. Therefore, it refused to provide him with copies of the phone logs and explained that it could do so only with the account holder’s consent. Bell also noted that the Complainant was not listed anywhere on the account at the time he submitted his access request.
22. Bell explained to our Office that a regular account can have up to 5 or 6 phonelines. However, within an account, Bell only allows one individual to be the account holder.
23. The account holder is financially responsible for the account. They are billed for all phone usage on the account, and if a bill is not paid, their credit is negatively affected. As a result, the account holder has complete control over the account.
24. An account holder can assign one or more additional individuals to the account as an “authorized user” or a “subscriber”. An authorized user is given many of the same abilities as the account holder, while a subscriber is connected to a specific phoneline on the account.
25. When an account has multiple phonelines, a subscriber for each phoneline is not necessarily registered. Consequently, Bell does not have clear records of who is the owner and/or user of a phoneline.
26. Because Bell considers all the information contained in the phone logs of a phoneline to be the personal information of the account holder only, Bell does not permit authorized users or subscribers to access any phone logs on the account without the account holder’s consent.

The requested phone logs contain the Complainant’s personal information

27. As explained further below, our Office finds that because the phone number in question belongs to the Complainant, the requested phone logs constitute the Complainant’s personal information.
28. Subsection 2(1) of PIPEDA states that personal information means information about an identifiable individual.
29. The Complainant asserts that the requested phone logs contain his personal information because he was the phoneline’s owner and user during the period for which he requested access to phone logs.
30. Bell never asked the Complainant to provide additional information showing that the phoneline belonged to him during the period for which he requested access to his phone logs. Rather, when Bell confirmed that the Complainant was not currently an authorized user on the account, it denied his access request.
31. Principle 4.9.2 states: “An individual may be required to provide sufficient information to permit an organization to provide an account of the existence, use, and disclosure of personal information. The information provided shall only be used for this purpose.”
32. If Bell was unable to rely on its records system to determine if a phoneline belongs to a specific individual (because the owner and/or user of a phoneline is not always registered in its system), it can, pursuant to Principle 4.9.2 of PIPEDA, request additional information from the individual to determine if they were the owner and/or user of the phoneline during the period relevant to the access request.
33. Our Office proceeded to obtain additional information from the Complainant to determine whether the phone number in question belonged to him during the relevant period for which he requested access.
34. Based on the evidence provided by the Complainant, we are satisfied that the phone number in question belonged to the Complainant. Specifically, the Complainant demonstrated that he was a signatory of the previous Bell account contracts; he used the same phone number before being on the shared plan with the ex-spouse; he used the phone number for over a decade; and he currently still uses the phone number in question.
35. Upon reviewing the phone logs in question, our Office found that they contain two categories of personal information: (i) information about the account; and (ii) information about the phoneline.
1. Information about the account includes information such as the account holder’s client ID number, name, billing address, contact information, the account number, and the account billing amounts.
2. Information about the phoneline includes the phone number, logs of calls and texts messages of the specific phoneline, namely, the incoming and outgoing phone numbers, the time, length, location (city), and the cost of all calls or text messages, whether the calls or texts included pictures and/or videos, as well as the daily data usage. The phone logs do not contain the content of any text messages or calls; Bell specified to our Office that it does not retain this information.
   
   
36. While the phone logs do not contain the Complainant’s name, we found that it does contain his phone number, and the activity related to that phone number. A cellphone number is often unique to a person and can reveal personal information about them, such as, the numbers they called, when, for how long, and the communication format (e.g., text, call, picture message, etc.). Therefore, the information about the phoneline in the phone logs constitutes the Complainant’s personal information.

The Complainant’s interest in accessing the phone logs is greater than the ex-spouse’s interest in non-disclosure of the phone logs

37. Subsection 9(1) of PIPEDA states that despite clause 4.9 of Schedule 1, an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the information about the third party is severable from the record containing the information about the individual, the organization shall sever the information about the third party before giving the individual access.
38. With respect to the account information contained in the phone logs, as described above, we find that this information belongs solely to the account holder and is severable from the remainder of the phone log.
39. As concluded above, we find that the information about the phoneline is the Complainant’s personal information, as the owner and user of the phoneline. However, Bell represented to our Office that the information about the phoneline constitutes the ex-spouse’s personal information, as the account holder. Bell explained that the ex-spouse is financially liable for the account, and that the duration, city location, and form of communication (e.g., video message or call) determines how much she is billed.
40. In considering whether to grant the Complainant access to his personal information that could also be considered the personal information of the ex-spouse, Bell should weigh the privacy interests of the Complainant and the ex-spouse, as well as the public interest in disclosure or non-disclosure of the information.^{Footnote 1} This balancing exercise is a fact-specific determination when personal information may belong to more than one person. In assessing the circumstances of this case, we find that the Complainant’s privacy interests outweigh the ex-spouse’s privacy interests.
41. On the one hand, the ex-spouse may have an expectation of privacy concerning the information about the phonelines, given that she has always been the account holder, the Complainant is no longer associated with the account, and because the Complainant never exercised any access rights to the phone logs under Bell’s account system without the account holder’s consent, even during the period when he had been attached to the account.
42. On the other hand, the phoneline is the Complainant’s personal phone number, and he was the sole owner and user of the phoneline during the relevant period. The information about the phoneline could reveal sensitive information about the Complainant, including information about his personal activities, such as the phone numbers that the Complainant communicated with, for what duration, on what date, from and to what city location, and whether a video and/or image was shared. The information about the phoneline is therefore significantly more personal to the Complainant than billing information that may be of interest to the ex-spouse.
43. Finally, we find that there is a public interest in disclosure to the Complainant. There is a public interest in protecting access rights in situations of shared accounts. As Bell only allows one individual to be the account holder for a shared phone plan, the individual who is not the account holder is left with limited recourse to access their personal information contained in the account. This may leave individuals vulnerable, particularly in cases of imbalances of power within relationships, where they may not want to seek the consent of the account holder to access their personal information.
44. Upon weighing the privacy interests of the Complainant and the ex-spouse in the information about the phoneline, and considering the public interest in disclosure, we find that these considerations weigh in favour of disclosure, such that Bell should have given the Complainant access to the information about the phoneline, even if it considered this information to also constitute the ex-spouse’s personal information.
45. Bell could have provided the phone log information to the Complainant, while redacting the information that solely constitutes the personal information of the account holder (i.e., the information about the account described above at para 35).
46. Therefore, we find that Bell contravened Principle 4.9 of PIPEDA by not providing the Complainant with redacted copies of the phone logs when requested.

Other - Openness

47. During the course of our investigation, we identified an additional concern regarding Bell’s compliance with PIPEDA’s Openness principle.
48. Principle 4.8.1. states: “Organizations shall be open about their policies and practices with respect to the management of personal information.”
49. We found that Bell’s privacy policy and other public facing communications do not mention that when individuals choose to have a shared phone plan, the specific details about an individual’s phone usage would be disclosed to the associated account holder.
50. While individuals could generally be expected to be aware that, when opting for a shared phone plan, their phone usage would be accessible to individuals on that same plan, it is not readily apparent that this phone usage would include such detailed information as the numbers they called, when, for how long, and the communication format (e.g., text, call, picture message, etc.).
51. In accordance with PIPEDA’s Openness principle, Bell should make this information readily available to customers, especially given that details about an individual’s phone usage could reveal sensitive personal information about them, and that financial incentives are generally given to share a phone plan.

Recommendations

52. We recommended that Bell provide the Complainant with access to the phone logs that he requested with redactions made to the account holder’s information. Bell complied with this recommendation during the course of the investigation.
53. While Bell has resolved this issue for the Complainant, we find that Bell’s current procedures for responding to access requests are inadequate, as its privacy policy provides that all information within a shared account (which would include phone logs) belongs exclusively to the account holder and can only be accessed with their consent.
54. Therefore, given the contraventions identified in this report, and with a view to enhancing Bell’s internal procedures so that it can appropriately respond to access requests for shared accounts and prevent similar issues in the context of personal cellphone lines on shared plans, which often involve family relationships, we recommend that Bell:
1. Adjust its internal procedures and provide training to employees to:
1. consider recording the name of the phoneline’s user and clearly record when they start and stop being the user of a phone number, a subscriber, or an authorized user on the account. This will assist Bell with keeping accurate records of who is using a specific phoneline, and will, in turn, assist Bell with assessing whether phone logs belong to an individual when faced with an access request for personal information.
2. request additional information, when Bell is aware of or has reasonable grounds to believe that the account holder and the owner and/or user of the phone are different individuals, to assess whether a phone number belongs to the individual making an access request, as permitted by Principle 4.9.2 of Schedule 1 of PIPEDA; and
3. provide the phoneline’s user with access to phone logs if Bell is satisfied that they constitute the phoneline’s user’s personal information, without requiring the account holder’s consent.
2. Address the Openness principle issue by making information available to customers, such as in the privacy policy and FAQ, explaining that:
1. the account holder’s consent will not be required to provide access to phone logs where they constitute the personal information of the user of the phone number making the access request; and
2. the account holder can access the details of the phone usage of any user of a phoneline connected to the account, including the number they called, when, for how long, and the communication format.
   
   
55. Bell has committed to implementing all our recommendations.

Conclusion

56. Based on the above, we have found that:
1. With respect to issue 1, Bell did not respond to the Complainant’s access request within thirty days and therefore contravened subsection 8(3) of PIPEDA. Since then, Bell has provided the Complainant access to his personal information. We thus find this aspect of the complaint well-founded and resolved.
2. With respect to issue 2, Bell did not adequately respond to the Complainant’s request to access his cellphone logs and therefore contravened Principle 4.9 of PIPEDA. Bell has committed to updating internal procedures and training to better provide phoneline users access to their personal information contained in phone logs. We thus find this aspect of the complaint well-founded and conditionally resolved.
3. With respect to the Openness issue identified during the investigation, Bell has committed to updating their privacy policy and FAQ in accordance with our recommendations. We thus find this aspect of the complaint conditionally resolved.