Personal information improperly disclosed to collection agency

PIPEDA Case Summary #2002-99

[Principle 4.3, sections 7(3)(b) and 5(3)]

Complaint

An individual complained that a telecommunications company improperly disclosed his unlisted telephone number to a collection agency that was pursuing a third party.

Summary of Investigation

In the fall of 2001, the complainant was contacted by a collection agency that was attempting to find an individual who owed the telecommunications company money. The complainant, who paid a fee to ensure that his telephone number was unlisted and inaccessible through directory service, discovered that his telephone provider had released his number to the collection agency as it had appeared on the missing debtor's phone records as a frequently called number. The complainant contacted the telephone company to indicate his concerns about this disclosure of his personal information. The company, in turn, contacted the collection agency and asked that the individual's name be removed from the collection file.

The telephone company argued that a telephone number, alone, with no other information, could not be considered personal information. It then argued that the number was the debtor's personal information and not the complainant's because it appeared in the debtor's telephone records. It also maintained that its policies, as well as its terms of service agreement, filed with the Canadian Radio-television and Telecommunications Commission (CRTC), allowed it to disclose such information, without the individual's knowledge and consent, when pursuing the collection of that customer's account.

The company also argued that it was both reasonable and appropriate for an organization to use all means at its disposal to collect on a debt and that it would not be in the public interest to find otherwise. The company's ability to collect on outstanding debts would be affected and customers could also avoid payment and collection thereby increasing the costs of providing telephone services and ultimately resulting in increased telephone rates.

Commissioner's Findings

Issued December 2, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because telecommunications companies are federal works, undertakings or businesses as defined in the Act.

Application: Section 2 of the Act defines personal information to be "...information about an identifiable individual...". Principle 4.3 states that knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Section 5(3) states that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. Section 7(3)(b) of the Act states that for the purpose of clause 4.3 of Schedule 1, an organization may disclose personal information without the knowledge or consent of an individual only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

The Commissioner concluded that the complainant's number was the personal information of both the complainant and the debtor. The debtor was an identified individual in relation to the telephone numbers in his billing records, and thus the numbers could reasonably be deemed his personal information. The Commissioner noted, however, that the Act states only that the individual must be "identifiable," not that the individual be identified. It also does not say that the personal information must be unique to an individual. Though, the complainant was not identified by name in the records, his telephone number made it possible for him to be identified. Therefore, the Commissioner was satisfied that his telephone number was his personal information.

The Commissioner considered the customer's expectation that that his unlisted number would remain confidential, available only to employees of the telephone company and anyone else the individual chooses. It was clear that the complainant expected his number to remain confidential. While the company argued that it had the right to disclose this information without the complainant's knowledge or consent because it was pursuing the collection of a debt, the Commissioner noted that the company may only invoke such exceptions when it is attempting to collect on a debt owed by the individual whose information has been disclosed. The complainant's account was not at issue and the company had no basis on which to explain its disclosure of the complainant's personal information. The Commissioner therefore found that the company had failed to comply with section 7(3)(b) and was therefore in contravention of Principle 4.3.

Turning to the company's argument that its actions were in the public interest, he deliberated as follows:

• A reasonable person would be likely to take a broader view of the public interest than the company had suggested. It would be a view that would encompass, for example, due respect for the privacy of personal information.
• A reasonable person would not consider the disclosure of personal information of one person to pursue the debts of another to be an appropriate purpose in the circumstances.

The Commissioner found that the company was in contravention of section 5(3).

He concluded that the complaint was well-founded.

Further Considerations

The Commissioner noted that this case raised the issue of what would have happened had the individual's telephone number been listed, technically making it publicly available information, which an organization can disclose without knowledge and consent, under section 7(1)(d). The Commissioner determined that, even if published, the individual's telephone number is still personal information. While the Act may provide that personal information can be disclosed without the individual's consent, he indicated that such disclosure would remain subject to the "reasonable person" test to determine the appropriateness of the purpose for the disclosure. In circumstances such as those of this case, where the personal information of one party was obtained from a third-party's account, and the information was disclosed for the purpose of tracking down that third party, the Commissioner concluded that a reasonable person would not consider such a purpose appropriate. Indeed, he indicated that it would be difficult to imagine any circumstances that would make such a practice appropriate.

The Commissioner therefore recommended that the company immediately cease its practice of disclosing telephone numbers, published or not, to collection agencies for the purposes of collecting a debt from a third party.