Individual objects to bank's ongoing collection and disclosure of personal information with credit bureaus

PIPEDA Case Summary #2003-206

[Principle 4.3.3 of Schedule 1; section 5(3)]

Complaint

An individual objected to a bank's requirement that he consent to the ongoing collection and disclosure of his personal information from and with credit bureaus and other financial institutions. He also alleged that the bank did not properly explain the reasons for its collection of the social insurance number (SIN) and the fact that such collection is voluntary.

Summary of Investigation

The complainant wanted to open a small business account, a mortgage-backed line of credit, and a credit card account with the bank, using his home as security. While he agreed to an initial credit check with respect to the application, he refused to authorize the ongoing reporting of the status of his loans. The bank consequently refused to process his application further without his consent.

Although the complainant acknowledged that the bank had the right to manage its level of risk, he nevertheless maintained that securing his loans with a mortgage against his home reduced the bank's exposure to risk to a negligible level. There was therefore no need to disclose regularly the status of his credit accounts to the credit bureaus. The complainant also did not believe that the bank needed to make ongoing inquiries about his credit worthiness.

The bank's purpose for the ongoing exchange of information is to maintain the accuracy, completeness and integrity of the information held by credit bureaus. For this reason, the bank is required by the terms of contractual agreements with the credit bureaus to supply regular, current information on the status of loans that it has granted.

This purpose is explicitly stated in the bank's privacy materials, which are typically given to prospective customers. While the complainant acknowledged that he received documentation from the bank, he could not recall the exact nature of the material provided to him.

With respect to the complainant's situation, the bank indicated that the exchange of information is needed to make a decision whether to approve or decline any small business credit application. It is then later required to assess the continuance of such credit or its treatment at renewal. In the case of revolving credit, which the complainant had wanted, the bank stated that the continued extension of credit is dependent on the customer maintaining a satisfactory credit standing. Ongoing exchange of information is therefore critical to the assessment process.

The bank typically collects financial information relating to the extent of the applicant's indebtedness, repayment behaviour and the existence of other claims against assets. It maintained that it collects or discloses only information that is relevant to fulfill the purpose identified in the application.

The consent clause on the application form indicated that, even after the banking relationship had ended, the bank might continue to disclose the applicant's personal information to credit bureaus and credit reporting agencies and that the applicant did not have the right to withdraw consent to such an action. The bank's policy is to report information to the credit bureaus for the period of time specified in the provincial legislation that governs credit reporting agencies.

As for the SIN, the complainant was under the impression that he was required to provide the SIN for the purpose of a credit bureau check. The field for the SIN on the application form in use at the time did not indicate that it was optional. However, in a related booklet given to him, it was indicated that provision of the SIN was optional. He challenged this requirement and was informed that he did not need to provide his SIN. The bank has since revised its application form to clearly indicate that the SIN is optional.

Commissioner's Findings

Issued August 5, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a bank is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3.3 states that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes. Section 5(3) establishes that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

The Commissioner found that a reasonable person would consider it appropriate for a bank to help to maintain the integrity of the credit reporting system on which it relies in order to make sound lending decisions. He accepted that the bank must periodically confirm with the bureaus that a person with revolving credit continues to be a good credit risk. He noted that in order for the bureaus to have such information, the bank must also disclose information on credit accounts on a regular basis not only because they are contractually obligated but also because they are duty bound as good corporate citizens to do so. Overall, he was of the view that the bank's purposes met the reasonable person test, as described in section 5(3), and was satisfied that the bank is limiting its collection and disclosure of personal information to these explicitly stated and legitimate purposes, as per Principle 4.3.3.

Regarding the SIN, the Commissioner noted that, despite the fact that the field for the SIN was not marked optional, the brochure the complainant received at the time of application indicated that providing the SIN was optional. Furthermore, the bank agreed that the SIN was not required when the complainant challenged it. He thus found that the bank had not contravened Principle 4.3.3. He was, however, pleased that the bank had changed its form to state clearly that the SIN is optional.

The Commissioner therefore concluded that the complaint was not well-founded.