Bank fails to maintain up to date, accurate personal information

PIPEDA Case Summary #2003-163

[Principles 4.6 and 4.6.3, Schedule 1]

Complaint

A credit card account holder complained that a bank had disclosed inaccurate personal information about her repayment history to a collection agency. She had received a notice from the collection agency advising her that her account was past due. She believed that she had discharged her obligations.

Summary of Investigation

The complainant and her husband experienced severe financial management problems after he was injured and subsequently unable to work. The couple subscribed to the services of a private agency that provides debt management services. The agency arranged for the orderly repayment of the principal portion of the couple's unsecured debts, including the credit card account in question. It forwarded regular payments over a four year period, and wrote to the complainant in 1991 to advise her that her debts had been discharged. She in turn wrote to the bank to confirm that she had met her obligations with respect to the credit card account. The bank did not respond. Fourteen months later, she received the overdue payment notice from the collection agency. She wrote to the bank shortly after and challenged the accuracy of its information.

The bank responded 10 days later, issuing a letter of apology. It advised the complainant that the final payment on her account had been incorrectly posted to another person's account. The error had been corrected, and the bank had confirmed that there had been no negative repercussions on the complainant's credit bureau record. The bank had determined that a clerk who handled the complainant's payments had made a keying error. The clerk had subsequently been counselled by her manager on how to double check work to avoid future errors.

Commissioner's Findings

Issued April 17, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because banks are federal works, undertakings, or businesses as defined in the Act.

Application: Principle 4.6 states that personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. Principle 4.6.3 goes on to state that personal information that is used on an ongoing basis, including information that is disclosed to third parties, should generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out.

The Commissioner determined that information about a person's loan repayment history is important information that is used on an ongoing basis to update a person's credit record and credit rating. If it is incorrect, it has the potential to lead to an embarrassing situation, such as a denial of credit, or, as in the case of the complainant, the receipt of an overdue payment notice from a collection agency. While the Commissioner accepted that some allowance must be made for human error in the ordinary course of events, the complainant's situation was unusual. She had a signed agreement with the bank for a special repayment regime, and she had written the bank at the end of that period to confirm that her debt obligations were discharged. The bank failed to respond and maintained inaccurate records until the complainant wrote again over a year later. He found therefore that the bank had not met its obligations under Principles 4.6 and 4.6.3 to maintain the accuracy and currency of the complainant's personal information.

The Commissioner concluded that the complaint was well-founded.

Other Considerations

The Commissioner noted that the bank had taken prompt action when the error was brought to its attention. It corrected the credit bureau information and ensured that its error had not affected the complainant's credit rating. He commented, therefore, that the bank had met its obligations under Principle 4.9.5. Principle 4.9.5 states that when an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information, and transmit an amended version to third parties having access to the information in question.