Credit agency accused of disclosing personal information without knowledge and consent

PIPEDA Case Summary #2003-141

[Section 2; Principle 4.3]

Complaint

An individual complained that a credit agency disclosed his personal information to a company in the United States without his knowledge and consent.

Summary of Investigation

The complainant, who is self-employed and operates a home-based business, received a telephone call from a U.S.-based company representative informing him that he had been pre-qualified for a line of credit. The representative told the complainant that she had his name, his company's name, and an old business address. When the complainant asked how the company had obtained this information, he was told that a credit agency had provided it.

Although the call was received on the complainant's business line, the complainant maintained that since his business was located in his residence and he was the sole/owner operator, any information about his company was his personal information.

The credit agency indicated that it does disclose business information. In this instance, the agency responded to a request for business information from one of its members in the United States. The agency purchased information from a company that compiles lists of businesses in Canada and then sold it to the U.S. firm. As part of this sale, information about the complainant's business, namely, the company's name, his name, the telephone number and an outdated business address, was disclosed.

The company from which the credit agency purchased this information gathers data from various publicly available sources, such as the yellow pages, telepages, superpages, and other marketing sources. It then contacts businesses to obtain additional information including the name of a contact person. Although the complainant was not aware of how he was added to the list, the company suggested that it likely obtained the information about the complainant's company from an advertisement in the yellow pages.

Commissioner's Findings

Issued March 10, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business and also to any disclosure of personal information by an organization outside the province for consideration. The credit reporting agency in question discloses personal information to clients across borders for consideration.

Application: Section 2 defines personal information as information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

The Commissioner determined that the information disclosed in this particular instance was business information about the complainant's company and not his personal information as defined in section 2. The Commissioner therefore found that the provisions of the Act did not apply.

The Commissioner concluded that the complaint was not well-founded.

Further Considerations

In reference to the complainant's argument that his business information was his personal information, the Commissioner commented that even if he were to have found that the information disclosed was personal information for the purposes of the Act, section 7(3)(h.1) permits the disclosure of personal information without knowledge and consent only if the disclosure is of information that is publicly available and specified by the Regulations. The Regulations Specifying Publicly Available Information state that publicly available personal information includes the name, title, address and telephone number of an individual that appears in a professional or business directory, listing or notice available to the public and is related directly to the purpose for which the information appears in the directory. The Commissioner indicated that the disclosure in this case would therefore still be permissible under the Act.