Bank agrees to cease performing credit checks on individuals who are no longer clients
Early resolved case summary #2017-003
July 5, 2017
- Organizations seeking to collect and use personal information after the termination of a business relationship with an individual should engage in a careful analysis of the purposes for such continued collection and use, the form of consent required and the sensitivity of the personal information continuing to be collected and used.
- Organizations should make reasonable efforts to provide complete and accurate information to individuals inquiring about the organization’s personal information handling practices to ensure that accurate and complete information is provided to the individual in response to their inquiries.
An individual alleged that a bank performed several credit checks on her without her consent over several years. She accessed her credit report from a credit reporting agency and noticed that the bank had performed close to 15 credit inquiries on her file. The individual was shocked because she had not been a customer of the bank for many years. She asked the bank to explain the reason the checks were performed and to identify the consent relied upon to do so. The bank responded that the inquiries originated from its marketing group and informed the complainant that they were not visible to organizations requesting her credit report, but only appeared on the report she requested personally. Unsatisfied with the response from the bank, the individual filed a complaint with our office, seeking answers to her questions, an apology and reassurance that the credit checks would no longer continue.
Summary of Investigation
Our office communicated with the bank in the context of its early resolution process. The bank’s internal investigation revealed that the marketing department was not the source of the credit inquiries. In fact, the individual had applied for a credit card and an online investment account with the bank in 2013, but the services were never activated and were subsequently closed. Still, the bank continued to perform soft credit inquiries on the complainant’s credit file at different points in time.
Generally, once a relationship between an individual and an organization ends, an organization must carefully analyze its continuing need to collect and use the individual’s personal information, for example, based on legal requirements to do so. In the specific circumstances of this complaint, our office expressed concerns over the fact that the bank engaged in the collection of the customer’s sensitive credit-related information, even after the termination of a business relationship with a customer and where there was no legal requirement to do so.
Report a problem or mistake on this page
- Date modified: