Parking lot owner collects debtors’ personal information from provincial vehicle registry

PIPEDA Case Summary #2007-375

[Principles 4.3 and 4.3.2; paragraph 7(3)(b)]

The complainant in this case alleged that a parking lot company improperly collected his name and address in connection with a parking violation. In fact, his name and address were not collected from the province’s database that contains basic vehicle-owner information. The company also had appropriate signage posted at the lot where the complainant parked, notifying customers that it collects such information from the province and why. The Assistant Privacy Commissioner concluded that the complaint was not well-founded.

The following is a detailed overview of the investigation and the Assistant Commissioner’s findings.

Summary of Investigation

The complainant had received a parking violation notice attached to his car from the parking lot owner for parking illegally at one of its lots. The violation notice states that “if this amount remains unpaid for more than 30 days, it will be forwarded to a debt collection agency for collection.” The notice further states that “if this amount is referred to a debt collection agency, or if we take legal action to recover this amount, additional costs and interest may be added as permitted by provincial debt collection legislation.”

Although he paid the ticket in full, the complainant was aware of the company’s ability to collect personal information from the province to enforce a debt and found it objectionable. The complainant was aware that the company has access to basic vehicle owner information from the Ontario Ministry of Transportation (the name and address are obtained when the parking lot owner provides the licence plate number).

The company stated that as the complainant paid his violation voluntarily and in a timely manner, it did not request or obtain any information from the Ministry regarding the registered owner of the vehicle nor did it share that information with any collection agency.

According to the company, if a violation is not paid in a timely manner, it requests access to the registered owner information for the vehicle through the appropriate provincial government authority (namely, the Ministry of Transportation). The information, specifically, the name and address of the registered owner, is obtained for the purpose of conducting follow-up collection activities on the outstanding violation.

Before receiving information from the Ministry, the parking company was required to sign and abide by a written access agreement. When the company requests information from the Ministry in accordance with the access agreement, it is only required to provide the licence plate number that it is searching. There is no requirement to provide the vehicle make or colour.

The Office reviewed the agreement between the company and the Ministry of Transportation, which is currently in force. It indicates that the parking company is allowed access to the Ministry’s electronic data, which is to be used to collect a debt. The company may in turn hire a collection agency to collect unpaid fines. Although the complainant’s information was not collected and thus not disclosed to any collection agency, he nevertheless objected to such a disclosure on principle.

The company provided us with photographs of the signage it posts at the lot where the complainant had parked. The sign indicates that:

We accept no responsibility for loss, theft or damage to vehicles or contents. We do not take custody of vehicle (sic), but rent space only.

By parking on this lot, you grant permission to the Ministry of Transportation of Ontario to provide registered owner information, including name and address for the vehicle you are driving, to (name of company) and its agents, for the purpose of collecting unpaid parking fees and violations fees.

The company’s policy is to prominently display similar signage in any location where it would propose to collect information from the applicable provincial organization in order to enforce payment.

The company’s web site contains the company’s privacy policy. The policy includes a section on access to registered owner information held by various provinces, which are governed by various user agreements.

Findings

Issued February 9, 2007

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. An exception to the requirement for consent may be found in paragraph 7(3)(b), which permits an organization to disclose personal information without knowledge or consent if the disclosure is for the purpose of collecting a debt owed by an individual to the organization. Principle 4.3.2 states that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

In making her determinations, the Assistant Commissioner deliberated as follows:

• Although there was no collection or disclosure of the complainant’s personal information, the Assistant Commissioner was concerned about the company’s practice of collecting names and addresses in connection with parking violations.
• She noted that, while there is a provision under the Act, namely, paragraph 7(3)(b), which allows an organization to disclose personal information to collect a debt, without knowledge or consent, there is no such like provision which allows an organization to collect personal information in order to pursue monies owed. Therefore, in order to collect such information for that purpose, knowledge and consent are required.
• The company has in place signage which meets the knowledge and consent requirement. The Assistant Commissioner therefore found that the company’s practice did not contravene Principles 4.3 and 4.3.2.

She therefore concluded that the complaint was not well-founded.

See also

#355 Funeral home’s disclosure in pursuit of a debt allowed under the Act

#130 Disclosure of personal information in the collection of a debt