Credit agency accused of improper disclosure of personal information

PIPEDA Case Summary #2003-150

[Principles 4.3 and 4.7]

Complaint

An individual complained that a credit agency improperly disclosed his personal information. Specifically, he alleged that the agency incorrectly posted his and his wife's car loan information to his son's credit file and then disclosed this information to a bank that had made an inquiry into the son's credit history.

Summary of Investigation

The complainant's son had applied for a line of credit with a bank and had been refused because of a car loan on his credit file that did not belong to him. When the son first approached the agency regarding the error on his file, the agency informed the son that, according to the car company, the loan was his. However, after the complainant contacted the car company, which clarified to the agency that the loan was in fact not in the son's name, but in the complainant's and his wife's, the agency amended the son's credit file accordingly.

The credit agency explained that it electronically receives loan information from the car company each month. The agency's computer system compares this information with all of its consumer credit files, and the information is posted to the individual's file that scores the most points or has the most matches.

In this case, the error occurred because the complainant's wife and son shared not only the same last name and address but also the same initial for their first names. Since the son's credit file had only his first initial and last name on it, and the car company had provided very limited information regarding the loan, the information about the complainant's and his wife's car loan was matched to the son's file. The agency acknowledged that, although rare, this has occurred in other files under similar circumstances.

As a result of this error, the complainant's information was disclosed to the bank. Pursuant to the filing of the complaint with the Commissioner's Office, the credit agency reconfirmed that the loan was not the son's and reissued an amended report to all members that had made inquiries into his credit history over the previous six months, including the bank. The agency also put the son on a manual monitor list, meaning that each month, an agency employee would check his file to ensure that the car loan did not reappear and would verify any entry that had only his first initial and not his full first name.

Commissioner's Findings

Issued April 11, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business and also to any disclosure of personal information by an organization outside the province for consideration. It was established that the agency disclosed personal information across borders for consideration (from the agency's office in one province to the bank's office in another).

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.7 stipulates that personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

In the Commissioner's opinion, the central issue in this case was protection. There was no dispute that the credit agency did not correctly report the complainant's loan and disclosed his personal information to a third party, without his knowledge or consent. The Commissioner considered whether the agency had appropriate safeguards in place that could have prevented this from happening. The agency admitted that incorrect reporting had occurred in other cases. On the evidence, it was clear that the agency had not sufficiently protected the complainant's personal information as stipulated in Principle 4.7, and as a result, disclosed his personal information without his knowledge and consent, in contravention of Principle 4.3.

The Commissioner thus concluded that the complaint was well-founded.

Further Considerations

In reviewing the case, the Commissioner noted a time lag of over two months between when the agency first learned of the problem and when it resolved it. The Commissioner recommended that, in cases such as this one, the agency add a notation to the file explaining that an item is in dispute and is under investigation. This would ensure that an organization accessing the individual's credit file during this period is aware that there may be an error in the file and can take this information into consideration when making a final decision regarding that individual. Otherwise, there is the risk that an individual could be very negatively affected, such as being denied a student loan, as in this case, or perhaps a mortgage, because a decision was made based on erroneous information.