Wireless phone company improves safeguards for estranged spouses

PIPEDA Case Summary #2006-329

(Principles 4.3 and 4.7 of Schedule 1)

A man claimed that his estranged wife obtained his new address and cell phone number from a wireless phone company.  Although there was no evidence that the company had disclosed his new contact information to his estranged wife, the Assistant Privacy Commissioner felt that the company could do a better job of protecting personal information in situations where the relationship between the holders of an account has ended.  The company agreed to implement new procedures in such scenarios.

The following is a detailed overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant and his estranged wife shared a cell phone account that consisted of two wireless numbers.  According to the company’s records, the complainant was listed as the user of the primary number, while his wife used the “mate” number.  Both had full account privileges; in other words, both had full access to account information and could make changes to the account.

The complainant stated that he visited one of the company’s retail outlets, informed the representative that he and his wife had separated, and asked to either cancel his wife’s account or to move it to her name, whichever was more appropriate.  The complainant also provided a new address and asked to have his wireless number changed.  He told the Office that he specifically asked that his wife not have access to his personal information.  The representative called the wireless company in order to process the request, and the complainant had the opportunity to discuss the cancellation of his wife’s account directly with the wireless company as well.  It takes 30 days for an account to be deactivated.

According to the complainant, shortly after he had made these changes, an acquaintance informed him that the complainant’s wife visited one of the company’s retail outlets, and obtained his new cell phone number and address.  The complainant subsequently received calls on his new wireless number from his wife.

According to the company’s records, when the complainant requested a new cell phone number, he was given one as part of the same account his estranged wife had access privileges to.  The account records further showed that four days after he made his request, his estranged wife made an inquiry regarding the status of the account.  However, there was no record of what information may have been disclosed to her.  The account was deactivated 30 days after the complainant’s request, in accordance with the terms of the service agreement.  During those 30 days, however, the wife had full access to the account.

The company contended that, if a disclosure occurred within 30 days of his request, it was done with the complainant’s consent as his estranged wife still had full account privileges.  According to the company, the complainant called the company to request the deactivation of the “mate” line and to change his billing address.  While he advised the representative that he wanted the line removed because he had separated from his wife and he no longer wanted to be responsible for the “mate” account, he did not ask to have his wife removed as an authorized user, so she remained on the account until the account was deactivated.  The company stated that it could not assume that a mention of a marital breakdown or discord signifies a request to delete the account status for one of the spouses.

The company wrote to the complainant to apologize for the inconvenience and to explain its position.  It appeared to recognize that the complainant’s wishes were not satisfactorily addressed.  As a corrective measure, the company planned to provide additional training to its customer service representatives to ensure that in situations such as the complainant’s, the representative notes that the estranged spouse is still on the account and asks the customer whether he or she wishes to remove the spouse’s account privileges.  Customers in such circumstances will also be offered password protection on the account, since many spouses are sufficiently knowledgeable about the details of the account to correctly respond to the profile-based questions typically posed by customer service representatives in order to verify the identity of the account holder.

Findings

Issued February 1, 2006

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate; and Principle 4.7 stipulates that personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

In making her determinations, the Assistant Privacy Commissioner deliberated as follows:

• With respect to the disclosure complaint, the Assistant Commissioner could find no evidence to support the allegation that the complainant’s address and cell number were disclosed to his estranged wife by an employee.
• She therefore could not find the company in contravention of Principle 4.3.  While she did determine that the complainant’s wife made a status inquiry on the account, at the time of the inquiry, the company’s records indicated that the estranged wife still had full account status.  Thus, had there been a disclosure, it would have technically been done with the complainant’s consent as per the service agreement. 

Accordingly, she concluded that the disclosure complaint was not well-founded.

• Regarding the safeguards issue, the company, as a result of the complaint and ensuing investigation, amended its procedures so that account holders will be specifically asked whether their estranged spouse should be removed from the account.  Password protection will also be offered.  The Assistant Commissioner was of the view that such procedures should ensure stronger protection of personal information in the company's care, and was therefore satisfied that these amended procedures brought the company into compliance with Principle 4.7.

The Assistant Commissioner therefore concluded that the safeguards complaint was resolved.