PIPEDA Case Summary #2008-398

[Principles 4,2, 4.3 and 4.3.2 of Schedule 1]

The Office of the Privacy Commissioner of Canada received complaints one year apart from two individuals who claimed that telemarketing agents from a particular bank had collected their personal information for a credit card application without consent. One of the complainants alleged that the bank had disclosed her personal information to a credit bureau without her consent. The other complainant alleged that the bank had also collected her credit report and used her personal information to process the application without her consent.

The Assistant Privacy Commissioner was disturbed by the transcripts of the calls made to the complainants. It was clear to her that neither complainant had clearly understood the substance of the calls and that their consent therefore had not been properly obtained. She concluded that the complaints of both individuals were well-founded.

In the second case, the Assistant Commissioner made a number of recommendations, to which the organization responded satisfactorily. It was therefore concluded that the complaints in this case were also resolved.

The following is a detailed overview of each investigation and the Assistant Commissioner’s deliberations.

First Case

Summary of Investigation

The complainant was contacted by a telemarketer who was attempting to sell her a credit card. The Office obtained a transcript of the call in question. In it, the telemarketer briefly stated the purpose of the call and then began asking the complainant questions. The complainant, whose first language was not English, was not given an opportunity to comment, nor did the telemarketer ask if he had the complainant’s consent to pose questions relevant to the application process.

Later in the call, the telemarketer informed the complainant that a credit card would be sent to her upon approval of the application. The complainant stated twice that she did not want the credit card. The telemarketer informed her that she could read the terms and conditions of the credit card agreement, discuss it with her husband, and then decide if she wanted the card. The complainant responded, “okay,” and the telemarketer then described the terms of the credit card agreement and asked whether the complainant had any other credit cards. The complainant again indicated that she could not afford them. The telemarketer continued, asking her how she would like her name to appear on the card and her language preference for correspondence.

The telemarketer repeatedly asked the complainant whether he had her permission to submit a credit card application. She hesitated, indicated her uncertainty, and asked for clarification. Specifically, she asked if she could go through the application process and then not accept the card. The telemarketer assured her that she could cancel upon reading the material that was to be sent to her.

The bank acknowledged that the call did not meet its telemarketing sales call standards, and took steps to review procedures with the telemarketer in question, as well as the other employee responsible for confirming that the complainant had agreed to submit the application. However, the bank was also of the view that it had obtained the complainant’s consent to undertake a credit check. It contended that it had a legal obligation to process a request for credit and to respond once it received consent. Nevertheless, as a result of the complaint, the bank did suppress the complainant’s name from its marketing lists. Our Office also confirmed that the credit inquiry was removed from the complainant’s credit file.

Findings

Issued October 26, 2004

Application: Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information. Principle 4.3.2 goes on to state that the principle requires “knowledge and consent”; that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used; and that, to make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

In making her findings, the Assistant Commissioner deliberated as follows:

• From the start of the call to the conclusion, it was clear that the telemarketer had failed to make a reasonable effort to ensure that the complainant understood the reason for the call or how her personal information would be used or disclosed.
• Although he had briefly stated the purpose of the call, the telemarketer quickly moved on to asking the complainant questions without giving her time to properly indicate whether she was even interested in applying for the card. Once she understood why he was asking for her personal information, she indicated on three separate occasions that she did not want the card. The telemarketer nevertheless persisted.
• Although the telemarketer had formally asked for the complainant’s consent to the credit check, the context in which the question was posed has to be considered.
• Specifically, prior to asking for her consent, the telemarketer had told her that she had the option of reading written material about the card (should her application be accepted) before deciding whether she wanted the card – albeit after her personal information had already been collected and disclosed to the credit bureau.
• Leaving aside the serious problems with the “negative sell” approach, it was clear from the transcript that the complainant thought she would have the opportunity to review written material before consenting to the credit check. Indeed, she insisted that she would look at the materials before going through with the application.
• Therefore, the bank did not make a reasonable effort to ensure that the complainant understood what she was consenting to, as stipulated in Principle 4.3.2, and did not have her consent to the collection and disclosure of her personal information, contrary to Principle 4.3.

The Assistant Commissioner concluded that the complaints were well-founded.

Second Case

Summary of Investigation

The second complainant, a senior citizen, also received a call from a telemarketer for the same bank, who was attempting to solicit a credit card application. Our Office reviewed the transcript of the call. After the telemarketer introduced herself, she informed the complainant that she was about to receive a credit card. First, though, the telemarketer asked her to confirm some information. The complainant was not given the opportunity to comment, nor was she asked if the telemarketer had her consent to ask her questions relevant to a credit application. The complainant went on to answer a series of questions regarding her date of birth, housing information (mortgages), employment status, sources of income and so on. The telemarketer asked the complainant for her social insurance number (SIN); however, after a brief exchange where the complainant was clearly having difficulty understanding what the telemarketer was requesting, the telemarketer discontinued the request for the SIN.

The telemarketer then asked whether the complainant would like a particular credit card feature concerning loans. When the complainant responded in the affirmative, a lengthy exchange followed in which the telemarketer elicited the complainant’s banking information. The complainant then asked why the telemarketer needed that information. When the telemarketer clarified the reason for asking for it, the complainant told her she did not need the money. The telemarketer continued the discussion on another point.

The telemarketer then finalized the credit card application by confirming the complainant’s name as it should appear on the card. After seven attempts, the telemarketer confirmed the complainant’s permission to submit a credit application. The telemarketer then terminated the call by advising the complainant that she would be transferred to an automated information line for further information on credit card highlights. Once the application was completed, the bank obtained a credit report.

In the bank’s opinion, the transcript demonstrated that the agent clearly stated why she was calling. When she initiated the call, she identified herself, the bank, and the purpose of the call. Shortly thereafter, she reiterated that she was offering a credit card and asked the complainant whether she agreed to fill out the application, which the complainant did. At the end of the call, the agent provided the complainant with the bank’s standard disclosure and obtained her permission to submit the application. The bank therefore concluded that its agent acted appropriately. It pointed out that the telemarketer did deviate from the script when she asked whether the complainant understood that the call concerned a credit card application, but in the bank’s opinion, this action supported its position that the agent clearly stated why she was calling.

Our Office asked the bank if it would consider including a statement at the beginning of the telemarketer’s call to confirm the consent of the customer, in addition to keeping the standard consent language used at the end of the call, where the telemarketer asks the customer for permission to do a credit check. Specifically, we suggested that the telemarketer ask if it was okay “to ask some personal questions in support of this credit card application?”

The bank agreed to test this approach for a month. The bank revised the script such that the telemarketer would ask the customer’s permission earlier in the call to proceed in taking an application. In fact, in two specific places within the script, the telemarketer would ask whether he or she could proceed with taking an application and asked for the customer’s permission to do so.

From a marketing perspective, the results of the campaign were not as favourable as the bank had expected. The bank provided our Office with details on the change in the sales rates. The bank believed that the change in the script affected the results of the campaign, as evidenced by the decrease in the response rate, and decided to cease using the revised script. The bank was concerned that if the Office recommended that it incorporate this change, and it was the only institution required to do so, it would be placed at a competitive disadvantage. It was therefore reluctant to incorporate such a practice unless it was set as an industry standard.

The Canadian Radio-television and Telecommunications Commissioner (CRTC) has the authority, under the Telecommunications Act, to establish telemarketing rules. The rules that are currently applicable provide that the telemarketer must identify the person and organization calling and that, upon request, provide the telephone number, name, and address of a responsible person the called party can contact. However, the CRTC rules do not address the issue of consent.

The Canadian Marketing Association has established a code of ethics, one of which addresses privacy issues, such as calling unlisted numbers, removing customers from the call list when requested, and calling only from a list that has the surname and the number. However this code of ethics makes no reference to the issue of consent.

Our Office spoke to a representative of a major domestic bank, who indicated that each bank creates its own scripts for the use of telemarketers.

Findings

Issued August 8, 2008

Application: Principle 4.2 stipulates that the purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. Principle 4.3.2 goes on to state that the principle requires “knowledge and consent”; that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used; and that, to make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

In making her determinations in the preliminary report, the Assistant Commissioner deliberated as follows:

• The bank contacted the complainant by telephone for the purpose of offering her the opportunity to apply for a credit card. A review of the transcript of the call revealed that there were several points in the conversation where it was clear that the complainant did not understand why the telemarketer was collecting her personal information and how it would be used.
• Although the telemarketer did later attempt to confirm the purpose of the call, the types of responses the complainant was providing should have indicated to the telemarketer that the complainant was having difficulty understanding the reasons for the collection and use of her personal information.
• The Assistant Commissioner therefore determined, firstly, that the purposes for the collection were not clearly identified at the outset, as required by Principle 4.2. Secondly, she was of the opinion that a reasonable effort was not made to ensure that the complainant understood the purposes for the collection and use, contrary to Principle 4.3.2, and therefore her consent was not meaningful.
• She found that the bank had collected the complainant’s personal information during the telephone conversation and from the credit bureau, and then used it, in contravention of Principle 4.3.

Recommendations

In her preliminary report, the Assistant Commissioner recommended that the bank implement on a permanent basis the amended script that it had previously tested. Specifically, she recommended that the bank’s telemarketing agents:

1. clearly state the purpose of the call;
2. ask for express consent before taking an application for a credit card;
3. explicitly outline the purpose for a credit check; and
4. explicitly request consent to perform a credit check.

The Assistant Commissioner also recommended that the bank’s telemarketing agents be instructed to terminate calls in instances in which the individual clearly does not understand what is being asked and why.

In response, the bank agreed to revise its telemarketing scripts in accordance with items (2) and (4) above and subsequently proof that it had implemented those recommendations. The bank also documented its technical compliance with items (1) and (3) above, and with the further recommendation that agents be instructed to terminate calls in which individuals do not understand the substance of the discussion.

Conclusion

On the basis of the bank’s satisfactory response to the recommendations, the Assistant Commissioner concluded that the complaints in this case were well-founded and resolved.