Reason for collecting telephone number not clearly explained

PIPEDA Case Summary #2006-338

(Principles 4.3.2, 4.3.3)

A complainant was upset that a department store retailer had placed a block on her credit card account when she refused to provide it with her new telephone number.  It turned out that the employee who was dealing with the complainant had not explained the reason for wanting her new telephone number very well.  The matter was resolved to the Assistant Privacy Commissioner’s satisfaction when the company wrote to the complainant, apologized to her, and more fully explained why it wanted her phone number to reactivate her credit card account.

The following is a detailed overview of the investigation and the findings.

Summary of Investigation

The complainant held a credit card issued by the retailer.  When she called the company to give it her new address, the customer service representative (CSR) asked for her telephone number.  The complainant refused to provide her home telephone number because she objects to telemarketing.  The complainant alleged that, after telling the CSR that she could not provide a work number because she did not work, the CSR told her that her card was being “blocked” from usage because it could not be verified that she could pay her bills. 

In its response to the Office, the company informed us that when a store-issued credit card has not been used for a period of 12 months, the company considers the account to be “inactive” and it will therefore be “blocked” from usage.  Typically, when a customer attempts to pay with an inactive credit card, the cashier will be prompted to contact the central credit department.  This department will then ask the customer to verify and update his or her contact information.  The company stated that it considers the provision of the telephone number to be a prerequisite for the reactivation of a credit card (it is used for future authentication purposes and to reach a customer in case any issues with the account arise). 

According to the company, this case was unusual because the complainant had contacted the company to update her contact information.  At the time of the call, her card account was inactive.  The company confirmed that she refused to provide any telephone number.  The agent was concerned that the person she was speaking to may not have been the true customer and therefore told the complainant that a block was being placed on usage of the account.  When the complainant called again later that day and spoke to another agent, the block was still not lifted because the complainant continued to refuse to provide her telephone number. 

The complainant indicated to the Office, however, that this explanation was not the same as the one the CSR gave her.  She stated that she was not told about the inactive status or that her telephone number was needed for identification verification purposes.

The Office reviewed the CSR notes regarding the conversations at issue.  There was no indication that the CSR informed her that the account was inactive and that the information was required to verify her identity.

The company wrote an apology letter to the complainant.  It acknowledged that it had not been clear in its explanation to her regarding the status of her account and the purpose for requesting her telephone number.  It then provided her with the same explanation it gave our Office.  It also indicated that it reviews guidelines and procedures every six months with its associates on how to properly handle customer queries regarding privacy.  The company has since instructed the representative in question on correct procedures.

Findings

Issued June 12, 2006

Application: Principle 4.3.2 states that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used.  To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.  Principle 4.3.3 stipulates that an organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes.

In making her determinations, the Assistant Commissioner deliberated as follows:

• The company requires that a customer’s telephone number be provided when the customer attempts to reactivate a previously inactive account, as part of its identification verification procedures. 
• When the complainant refused to provide this information, the CSR placed a block on the account because she was not sure that she was speaking to the true customer. 
• While this purpose is legitimate, and the company was not asking for more information than necessary for such a purpose, in keeping with Principle 4.3.3, the company acknowledged that the explanation given to the complainant for the collection was not clear. 
• The company apologized to the complainant, and provided her with a clearer explanation regarding the reason for requesting the telephone number.  It has also instructed the CSR on correct procedures.

Consequently, the Assistant Commissioner concluded that the complaint was resolved.