Phone company discloses personal information without customer's knowledge and consent

PIPEDA Case Summary #2003-172

[Principles 4.3 and 4.3.5]

Complaint

An individual complained that her telephone company, via its call display service, disclosed her name and unpublished telephone number without her knowledge and consent.

Summary of Investigation

During the course of a telephone conversation with a representative of another organization, the complainant was addressed by her name. The complainant, who had not provided this information, asked the representative how she knew her name. The representative informed the complainant that her name and number appeared on the representative's call display screen.

The call display service allows any individual who subscribes to the service to identify callers on their telephone's call display screen. The complainant had an unpublished telephone number and assumed that it would be kept confidential when she placed outgoing calls.

Information about the service can be found in the company's white pages, under sections pertaining to the service and privacy. Both sections state that non-published numbers appear on call display screens and describe blocking options available to anyone who does not want his or her number to appear. The complainant was not aware of these options and thus did not use any of them.

The company also sent out pamphlets on this issue on two occasions when the service was first being introduced. It also instructs its customer service representatives to inform individuals subscribing to the non-published telephone service of the privacy implications of its call display service and to offer them blocking options. A welcome package is sent to new subscribers that directs them to view the terms of service in the white pages and on the company's Web site. The terms of service, however, do not specifically describe call display or its privacy implications.

As for the feasibility of having the personal information of non-published telephone number subscribers automatically blocked from appearing on call display screens without any action on their part, the company responded as follows:

• it did not believe that non-published number subscribers have a reasonable expectation that their number will not be displayed on a display screen of a party called who had subscribed to call display service;
• the service offered to non-published customers is the omission of a directory listing - this does not necessarily mean or reasonably imply that a caller's name will not be displayed. This is indicated in the company's general tariff, available by calling it, visiting one of its stores, on its Web site or through the CRTC. The non-published fee does not guarantee an otherwise "private" or "confidential" number will never be disclosed;
• since the privacy rights of callers and those called are equally important, call display service balances the rights of both sides. Call display helps protect the privacy of people called. To protect the rights of callers, the company offers a universal free per call blocking option which gives them control of when to disclose or not disclose their number; and
• after a very lengthy and costly public process prior to the last approved tariff in 1994, the CRTC concluded that the introduction of call display with appropriate built-in safeguards would provide subscribers with the ability to select the most appropriate means of protecting their own privacy concerns. The CRTC observed that providing call blocking to all non-published number subscribers would significantly erode both the value of the call display service and the effectiveness in reducing annoying and offensive calls. The CRTC concluded that a net benefit would be achieved by such a service and that it was in the public interest to approve the service.

In sum, the organization was of the view that subscribers to the non-published service were made aware of the options available to block their number from appearing on call display screens. Any proposed amendment to the general tariff would be costly, time-consuming, and would not necessarily guarantee that the default position of the call display service would be amended to block the numbers of non-published subscribers.

Commissioner's Findings

Issued April 28, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.5 states that in obtaining consent, the reasonable expectations of the individual are also relevant.

The Commissioner acknowledged that the company had taken steps to inform its customers of the privacy implications of its call display service. However, with the exception of the pamphlets it sent to its customers in 1992 and 1994, most of the company's efforts have been focussed on informing new customers of the blocking options available. It has instructed customer service representatives to inform individuals subscribing to the non-published number service about the implication of call display and blocking options. Since 1994, it has included information on this issue in its telephone directory. If there is a gap, it was that the welcome package should be more informative with respect to call display and unpublished numbers.

Generally, the Commissioner was of the view that new subscribers are being reasonably informed of the privacy implications, and that by going forward with the non-published service, they are consenting to the possible disclosure of their number. When it comes to new subscribers, therefore, the requirements of Principle 4.3 appear to be met.

However, the same could not be said of long-time subscribers, such as the complainant, who clearly did not know that her non-published number would appear on call display screens. While the Commissioner acknowledged that all customers would have received pamphlets in 1992 and 1994, and that mention was made in these notices that non-published numbers would be displayed, he was of the view that no special effort had been undertaken to alert non-published number subscribers to this fact. He noted that a subscriber to a non-published number service but not to call display might not have read the pamphlets. For a similar reason, the same individual would not likely look in the telephone directory under call display or privacy issues to find out if their number would appear on the screen. Such an individual would assume that his or her unpublished number would remain thus under all circumstances. As a result, the Commissioner determined that the company had not obtained the informed consent of subscribers who had non-published numbers when call display came into effect, and thus contravened Principle 4.3.

The Commissioner stressed that the customer's assumptions, or reasonable expectations, played a key role in the matter of consent. He strongly disagreed with the company's view of the non-published subscriber's reasonable expectations. In his opinion, when an individual pays for a non-published number, whether a long-time customer or a new subscriber, he or she expects that the number will remain protected and will not appear on call display screens. Such an individual is purchasing a service for the purpose of remaining anonymous. The onus, therefore, should not be on the individual to take steps to block the number from appearing but rather on the company to automatically provide call blocking as part of its non-published service.

The Commissioner therefore found that the company had not taken into consideration the reasonable expectations of the non-published subscribers, as relevant under Principle 4.3.5.

The Commissioner therefore concluded that the complaint was well-founded.

Further Considerations

While the Commissioner recognized that the company would have to return to the CRTC in light of its earlier decision, he nevertheless recommended that the company take steps to ensure that the personal information of non-published telephone number subscribers is automatically blocked from appearing on call display screens without requiring any action on the part of the subscriber.