Consumer complains about requirement to provide identification in order to obtain credit report

PIPEDA Case Summary #2006-324

(Principles 4.7.1, 4.9 and 4.9.2)

Complaint

An individual was unhappy that a credit bureau asked him to provide two pieces of identification before it would send him a copy of his credit report.  Since he refused to provide the information, the bureau would not send him the report.  He in turn complained to the Office that he had been denied access to his personal information. 

The Privacy Commissioner, however, agreed with the bureau that it was necessary to verify the requestor’s identity before releasing such sensitive information.  She noted that under the Personal Information Protection and Electronic Documents Act, organizations can ask for sufficient information prior to providing access.  She pointed out that such a request was also a means of protecting the individual’s information from unauthorized access.  The following is a detailed account of the investigation and findings.

Summary of Investigation

The complainant wrote to the credit bureau requesting a copy of his credit report.  Four days later, the credit bureau responded, indicating that its policy is to require current identification in order to ensure that it properly identifies the individual making a request.  It enclosed a request form for the complainant to complete and asked him to send the requested information to the attention of the credit bureau’s privacy officer.  The credit bureau also explained to the complainant that it was governed by various pieces of credit reporting legislation across Canada, and any information reported on any consumer is gathered and disclosed in a manner consistent with the provisions of the applicable legislation.  In this case, the applicable legislation was Ontario’s Consumer Reporting Act. 

The form given to the complainant states that the requestor must include both sides of two pieces of photocopied identification from the following list:

• Driver’s Licence
• Passport
• Certificate of Indian Status
• Age of Majority/Provincial ID
• Citizenship Card
• Department of National Defence Card
• Firearms Acquisition (only with photo)
• Credit Card (Primary account holder)

• Or one of the above along with the following:

• Credit card (secondary account holder)
• Birth Certificate
• T4 Slip
• Social Insurance Number (optional)

Over the course of the ensuing months, the complainant continued to write to the credit bureau requesting his personal information, and the credit bureau continued to respond that, before it could do so, it required two pieces of identification from him.  The complainant refused to supply the information as he believed that the credit bureau does not require two pieces of identification to provide him with his credit report.

As a result, the credit bureau did not supply him with the information.  It stated that it has this policy in place to protect the security of personal information.  It indicated that it uses the identification provided by the requester to authenticate the consumer prior to providing him or her with the information.

According to the credit bureau, this policy is an industry standard and is consistent with Principles 4.7.1 and 4.9.2 of the Personal Information Protection and Electronic Documents Act, as well as with provincial consumer reporting legislation.  Section 12(3) of Ontario’s Consumer Reporting Act states the following with respect to methods of disclosure:

(3) The disclosures required under this section shall be made to a consumer,

(a) in person if he or she appears in person and furnishes proper identification;

(b) by telephone if he or she has made a written request, with sufficient identification, for telephone disclosure and the toll charge, if any, for the telephone call is prepaid by or charged directly to the consumer.

The Office contacted another major credit bureau in Canada, which confirmed that it has the same identification requirements as the credit bureau at the centre of this complaint.  The complainant remained unconvinced, and pointed out that an individual may access his or her credit report online, for a fee, without having to submit a photocopy of two pieces of personal identification.

The Office reviewed the credit bureau’s online system.  It asks the consumer to provide personal information that verifies the identity of the individual, namely, the social insurance number, date of birth, current address, previous address (if changed within the past two years), one credit card number and credit limit, or instalment loan account number (if the individual has an instalment loan, such as a student, auto, jewellery, or furniture loan).  In addition, the consumer is presented with a series of questions to verify his or her identity.

It should be noted that the online process still requires the requestor to provide identification for customer authentication purposes.

Findings

Issued January 9, 2006

Application: Principle 4.7.1 stipulates that security safeguards shall protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.  Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information.  An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.  Principle 4.9.2 stipulates that an individual may be required to provide sufficient information to permit an organization to provide an account of the existence, use, and disclosure of personal information.  The information provided shall only be used for this purpose.

In making her determinations, the Privacy Commissioner deliberated as follows:

• She disagreed with the complainant’s view that the credit bureau should not be allowed to ask for two pieces of identification from a requestor, noting that Principle 4.9.2 of the Act allows organizations to require sufficient information of individuals so that they may provide the individual with access to his or her personal information. 
• She was therefore satisfied that the credit bureau’s request was in keeping with this Principle.
• Although the credit bureau did not provide the complainant with the information he was seeking, the Commissioner agree that the bureau first needed to authenticate the complainant’s identity before it could provide him with access.  Consumer reporting legislation requires identification verification.  Moreover, she noted, it is a means by which the credit bureau may protect the personal information it has from unauthorized access, which is also required under Principle 4.7.1 of the Act. 
• She therefore found that the credit bureau had not contravened Principle 4.9.

She concluded that the complaint was not well-founded.