Bank requires credit check on small business account applicant

PIPEDA Case Summary #2003-117

[Principle 4.3.3 and Section 5(3)]

Complaint

An individual complained when his bank required him to consent to a personal credit check in order to open a small business account.

Summary of Investigation

When the complainant attempted to open a small business account, he was informed that a personal credit check would be conducted on him. He objected to this requirement, stating that he was not asking for a loan or credit but was simply opening an account.

A review of the bank's documents on opening a small business account provided to the customer indicates that a personal credit check is carried out on the applicant as a requirement of service. If the customer does not consent, the bank retains the option of refusing service.

In support of its position that it should be able to run a credit check, the bank focussed on the differences between this case, involving small business accounts, and the Commissioner's earlier findings (see PIPEDA Case Summary #40), concerning another bank's practice of running credit checks on individuals seeking to open a personal bank account, but who are not seeking any form of credit. The bank contended that, unlike the individual, who enjoys a prima facie right under the Bank Act to open a personal bank account on satisfying minimum identification requirements, businesses do not have such a legislated entitlement. Therefore, the opening of a small business account should be based on a contract, with terms and conditions set by the bank, and with the company free to choose among products and to decide whether or not to do business with the bank.

The bank asserted that a personal credit check must be one of its terms and conditions because it helps prevent fraud and minimize operational losses and liabilities associated with small businesses, which typically have a high failure rate and pose a high risk of fraud. The bank maintained that jurisprudence imposes a significant amount of liability on banks, particularly when they have not done sufficient research into the background of their customers' financial activities. It further asserted that a bank is in effect extending credit since it is exposed on basic small business account transactions to high rates of insolvency, the risk of being overdrawn, and a high instance of fraud. By assessing the credit worthiness of the individual behind the business, the bank maintained that it has a better idea of the credit worthiness of the business and can therefore minimize its risk of losses. The bank also asserted that information about small businesses is generally unavailable or unreliable. It also contended that other safeguards, such as lengthy hold periods for cheques, would be neither acceptable to small business customers, who need access to funds swiftly and regularly, nor to banks, which would incur huge costs to monitor accounts for such long periods.

Commissioner's Findings

Issued February 11, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking, or business as defined in the Act.

Application: Principle 4.3.3 states that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes. Section 5(3) establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

While the Commissioner understood the complainant's position and was sympathetic to those small business account applicants who wish to have their personal and business affairs dealt with separately, he noted his obligation to balance the rights of individuals with the need of organizations to collect, use or disclose personal information for appropriate purposes.

The Commissioner noted that, in contrast with an individual attempting to open a personal bank account, banks are not obligated by legislation to accept an application for a business account unconditionally.

The Commissioner is on record as stating that credit checks should be reserved for assessing the financial risk of an individual actively seeking credit. While the complainant in this instance indicated that he was not applying for a loan or credit, the bank argued that the maintenance of small business accounts is tantamount to extending credit, given the high rate of insolvency, the risk of being overdrawn, and the high instance of fraud associated with small businesses. The Commissioner accepted that the bank does have liabilities and some credit risk, and he therefore found that the bank's purposes were legitimate, as per section 5(3).

As for less privacy-invasive measures, the only alternative would be to hold cheques for a lengthy period, which the bank asserted would be detrimental to small business and would create an unnecessary burden for banks. The Commissioner, however, questioned whether lengthy holding periods were required in this age of electronic communication. In his view, financial institutions could likely conclude whether there were sufficient funds to cover a cheque in much less time. Nevertheless, he was cognizant that a personal credit check is an important tool for the bank, particularly in the case of a sole proprietorship, where it may be difficult to completely separate the interests of the individual from those of the business, and that, on the whole, the bank has limited options, apart from the credit check, for fully assessing the risks it faces. Therefore, he accepted that a personal credit check is reasonable to achieve the bank's purposes and that the bank was not in contravention of Principle 4.3.3.

However, the Commissioner stated that, although he concluded that the complaint was not well-founded, were he at some future time required to investigate a similar complaint where he was presented with persuasive evidence confirming his reservations, his findings might well be different.