Individual objects to agency's delayed response to request for credit history

PIPEDA Case Summary #2002-102

[Principles 4.9, 4.9.6, Schedule 1; and sections 8(3) and 8(5)]

Complaint

An individual complained that a credit reporting agency had failed to respond to his request for access to his personal credit history.

Summary of Investigation

The complainant made a written request for a copy of his credit history on October 22, 2001. In a letter of acknowledgement dated November 21, 2001, the agency in question stated that the request could not be processed within 30 days because of increased volume at the time. This letter also notified the complainant of his right to complain under the Personal Information Protection and Electronic Documents Act (the Act). The complainant received his personal information on January 24, 2002, well in excess of the 30-day time limit set out in the Act.

The agency had indeed been experiencing a significant increase in the volume of access requests, with attendant processing delays. Pending the hiring and training of additional staff to handle the influx of requests, the agency had decided to inform requesters by letter that delayed response was likely.

The agency has taken steps to clear the backlog of requests and deal more expeditiously in future with what appear to be constant increases in volume. Since February 2002, the agency has been responding to access requests within eight days on average.

Upon receipt of his credit history, the individual asked the agency to investigate an entry on his file, which he stated was not related to him personally but was associated with a corporation of which he had been the director. The agency responded that it would not remove the item as it had been recorded accurately. Since the complainant's challenge was not resolved to his satisfaction, the agency provided the individual with the opportunity to write a statement for the credit file disagreeing with the entry. The complainant did so, and the agency attached this to the file and transmitted this information to third parties that had access to the complainant's information.

Commissioner's Findings

Issued December 19, 2002

Jurisdiction: As of January 1, 2001, the Act applies to any federal work, undertaking, or business and also to any provincially regulated organization that discloses personal information for consideration outside the province. The Commissioner has jurisdiction in this case because the credit reporting agency in question, though provincially regulated, discloses personal information to clients across borders for consideration.

Application: Principle 4.9 states that upon request an individual must be informed of the existence, use, and disclosure of his or her personal information and given access to that information; and that the individual must be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(3) states that an organization must respond to a request with due diligence and in any case not later than 30 days after receiving it. Section 8(5) states that an organization failing to respond to a request within the time limit is deemed to have refused the request. Principle 4.9.6 establishes that when a challenge is not resolved to the satisfaction of the individual, the substance of the unresolved challenge shall be recorded by the organization. When appropriate, the existence of the unresolved challenge shall be transmitted to third parties having access to the information in question.

The agency did not dispute that it had failed to provide the complainant with his requested personal information within the 30-day time limit set out in section 8(3) of the Act. The Commissioner found therefore that the agency had not met its obligation under section 8(3), was thus deemed under section 8(5) to have refused the requests, and had been in contravention of Principle 4.9 of Schedule 1.

Nevertheless, he was pleased to note that the complainant received his information. The Commissioner was also satisfied that the agency met its obligations under Principle 4.9.6 when it offered the complainant the opportunity to provide a statement regarding the disputed entry, which it then recorded, attached to the credit file and undertook to transmit to any third parties having access to the individual's credit information.

The Commissioner concluded that the complaint was well-founded and resolved.