Telecommunications company disclosed customer's personal information

PIPEDA Case Summary #2003-225

[Principle 4.3]

Complaint

An individual complained that a telecommunications company disclosed to her aunt the fact that she was indebted to the company. Specifically, the complainant alleged that her aunt received a telephone call from a representative of the company's credit department, asking to speak to the complainant. When informed that she was not at home, the representative asked that the complainant contact her at the credit department and left a telephone number and reference number.

Summary of Investigation

The complainant and the company had been involved in a billing dispute. After repeated attempts to collect the money owed, the company sent the debt to a collection agency. The agency sent the complainant a letter and left a message at her telephone number, which the complainant did not return. Shortly afterward, the complainant terminated her telephone service with the company and did not provide a forwarding number until some months later.

The collection agency representative then called the aunt, who was listed as a reference in the complainant's credit profile. The complainant had provided her aunt's name and telephone number as a reference to be contacted by the company to convey a message. When collecting this information, the company tells customers that the contact number is used for message purposes only.

Although the representative did not recall this exact conversation, she insisted that she would have followed the script that is used when calling references. She would have asked to speak to the complainant. When told she was not there, the agency representative would have stated that she was calling from the company's credit department and would have asked that the complainant call her.

As a result of this complaint, the company altered the script used by employees leaving messages with reference names. Instead of stating that the representative is calling from the company's credit department, the employee now states that he or she is calling from the company.

Commissioner's Findings

Issued October 8, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because a telecommunications company is a federal work, undertaking or business as defined in the Act.

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Although the complainant had given the company consent to contact her aunt to leave a message, the agency representative had done more than simply leave a message. When the representative named the section of the company that she was calling from, the aunt was able to infer that her niece owed the company money. It was unlikely that the complainant had such a disclosure in mind when she gave the company consent to call her aunt for message purposes. The Commissioner therefore found that the company had disclosed the complainant's personal information without her consent, in contravention of Principle 4.3 of Schedule 1.

The Commissioner concluded that the complaint was well-founded.

Further Considerations

The Commissioner was pleased that the company has since altered its script so that employees leaving messages with references ask that debtors call the company rather than the company's credit department.