Credit bureau sets retention period for positive information

PIPEDA Case Summary #2006-326

(Principles 4.5 and 4.5.2)

Complaint

Two individuals complained that a credit bureau was keeping positive credit information beyond a reasonable time limit.  During the Office’s investigation, the credit bureau recognized that it needed to establish a maximum retention period for such information, and the Privacy Commissioner concluded that the matter was resolved.

The following is a detailed overview of the investigation and findings.

Summary of Investigation

The retention period for negative information on credit reports is mandated by provincial legislation.  It is up to the credit reporting agency, however, to set its own retention policy for positive information. 

At the time of the complaints, the credit bureau did not have a written policy regarding the retention of positive data.  If a customer specifically requested the removal of positive information, the bureau’s policy was to comply with the request after explaining to the customer the possible ramifications of removing the information.  According to the bureau, positive information is used for an individual’s credit rating indefinitely, and can make a difference if, for example, an individual has had little experience with credit.  Another credit reporting agency has a retention policy that states that all credit and banking information will be automatically purged after six years.

The credit bureau has since evaluated its retention policy, and conducted consultations with various stakeholders, such as clients, suppliers, and its data centre.  It informed the Office that, effective immediately, it will maintain positive information for 20 years.   According to the bureau, in the course of evaluating the length of time positive information should be retained, it discovered that thousands of individuals’ credit files only contained positive information that was over 15 years old.  This situation can occur when an individual has declared bankruptcy, and the negative information has been deleted in compliance with provincial legislation.  Thus, if the retention period was 15 years or less, their entire credit histories would be deleted.  Retaining information longer than 15 years is therefore of benefit to those thousands of individuals.

Findings

Issued January 18, 2006

Application: Principle 4.5 states that personal information must be retained only as long as necessary for the fulfillment of the purposes for which it was collected.  Principle 4.5.2 indicates that organizations should develop guidelines and implement procedures with respect to the retention of personal information and that such guidelines should include minimum and maximum retention periods.

In making her determinations, the Privacy Commissioner deliberated as follows:

• At the time of the complaints, the credit bureau did not have a maximum retention period for positive information, contrary to Principles 4.5 and 4.5.2, and retained information indefinitely, unless an individual specifically requested the removal of the information.
• The bureau has since developed a policy whereby positive information is retained for a maximum period of 20 years.  Such a retention period, it states, is beneficial to those thousands of individuals who otherwise would have no credit history at all.  Individuals can still request that their information be deleted from their credit history prior to the 20-year mark.

The Commissioner therefore concluded that the complaints were resolved.