Customer objects to Social Insurance Number on address label of telephone bill

PIPEDA Case Summary #2002-57

[Principle 4.5, Schedule 1]

Complaint

An individual complained that a telecommunications company had improperly disclosed his personal information, specifically his social insurance number (SIN), without his knowledge and consent, on the address label of an envelope.

Summary of Investigation

After closing his telephone account, the complainant had received a final bill addressed with a label showing his SIN in the middle of his name. On telephoning the company's customer services group to complain, he received a verbal apology and an assurance that the disclosure was an isolated error. Not satisfied, he brought the matter to the attention of the CRTC, which prevailed upon the company to issue him a formal letter of apology. This letter explained the disclosure of the SIN as being the result of an employee's data input error.

There was no dispute that the complainant had originally provided his SIN to the company voluntarily. The data input error had probably occurred when some of the complainant's personal information was downloaded from the company's customer profile database into a smaller database used by credit services staff in closing accounts. The company issued a memo to all employees and managers in that section, reminding them of the need for caution in downloading data, given that address labels would subsequently be generated automatically and errors could have serious consequences.

Commissioner's Findings

Issued July 2, 2002

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction because telecommunications companies are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.5, Schedule 1, states that personal information should not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.

The Commissioner determined that the company had disclosed the complainant's SIN on an address label without his knowledge and consent in circumstances to which no exception under the Act applied. He found therefore that the company had contravened Principle 4.5.

However, he was satisfied that the disclosure had been the result of inadvertent and isolated human error. He was mindful also that the company had responded to the complainant's concern with a letter of apology and had taken steps to prevent a recurrence of the error.

The Commissioner concluded that the complaint was well-founded.