Complaint under PIPEDA against Accusearch Inc., doing business as Abika.com

July 27, 2009

---

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the Act)

1. In December 2004 and March 2005, the original complainant alleged, on behalf of the Canadian Internet Policy and Public Interest Clinic (CIPPIC), that the U.S. company Accusearch, Inc., d/b/a Abika.com (Abika), was

1. collecting, using, and disclosing the personal information of Canadians without their knowledge and consent,
2. compiling and disclosing inaccurate personal information through its “psychological profile” service; and
3. collecting, using, and disclosing personal information about Canadians for inappropriate purposes.

2. Our Office conducted a preliminary investigation in which it was concluded that there was insufficient evidence to support a recommendation. Following this investigation, in a letter dated and publicly released on November 18, 2005, my predecessor, Assistant Commissioner Heather Black, notified CIPPIC that our Office could not proceed further with its complaints because we lacked jurisdiction to compel U.S. organizations to produce the evidence necessary for conducting the investigation. Its complaint file having thus been closed, CIPPIC applied to the Federal Court in January 2006 for judicial review of the matter.

3. In February 2007, the Court rendered its decision to the effect that PIPEDA gave the Privacy Commissioner of Canada jurisdiction to investigate complaints relating to the transborder flow of personal information, including flows across the U.S. border. The Court ordered that the matter be returned to the Office of the Privacy Commissioner for investigation. Our Office subsequently informed CIPPIC that its complaints had been reopened as a result of the Federal Court decision.

4. In late 2008, the original complainant left CIPPIC and was replaced by a second complainant acting on behalf of the clinic. As a result, the original complaints were assigned new file numbers.

Summary of Investigation

5. Abika is a U.S.-registered virtual company that provides a variety of search services on individuals. In March 2005, Abika described itself on its website as follows:

“[Abika is] a person to person (P2P) Internet Search Engine that enables access to an extensive network of various court researchers, licensed private investigators, information brokers, public records, data archives, people with relevant knowledge and other databases. Abika.com provides order processing, delivery, customer service and profiling technology while the actual records search results are provided by various court researchers, information professionals, licensed private investigators, information brokers and anyone who can search relevant information.... Conventional search engines crawl the web and create an index of web pages and data that is on computers while Abika.com creates an index of people who are skilled searchers or have knowledge of other people.”

6. Abika’s 2005 website listed by name and occupation 147 individuals who provide such search services for Abika. The company added the following disclaimer:

“The above listed search experts work independently and are not employees of Abika.com. Abika.com does not know how they do the searches or what databases they use to fulfill the search requests.”

7. As the basis for her complaint that Abika was compiling and disclosing inaccurate personal information, the original complainant provided our Office with a copy of a psychological profile of herself that she had requested and obtained from Abika for a fee of $100. She also provided a copy of Abika’s website, dated November 25, 2004, where the company’s “Psychological and Personality Profiles” services were described. This section was introduced as follows:

“Personality and Psychological Profiles can help reveal a persons [sic] special talents, emotional makeup, history of good deeds, sexual orientation, tendency to cheat, their attention span, tendency to lie or be secretive, history of abuse and many other unconventional behaviors. Who does not wish to avoid being hurt in a relationship. Who does not wish to avoid a potentially abusive spouse or boyfriend/girlfriend. By Comparing Behavioral attributes from known abusive people, you can ensure that you do not get into similar abusive situations again. Studies show that by comparing one person’s behavioral attributes to another, one can effectively predict future behaviors. This can enable you to avoid people who could hurt you or are not compatible with you. Who does not wish to find that compatible person. Using Behavior matching you can ensure that your special someone is compatible to your needs and desires. Dr Michael Moynagh and Richard Worsley have completed studies whose patrons include the Archbishop of Canterbury and the foreword is written by British Prime Minister Tony Blair. The study concludes that Psychological profiling will be the way to screen one’s ideal partner – and with all this accurate matchmaking, the divorce rate could fall, the study says. Psychological profiling can help estimate personality traits and special talents that can then be verified by other facts.

“If you are going on the first date psychological profiling is the way to go. By knowing in advance about your date’s behavior history you can make your date a success. For example you wouldn’t be asking your date to go bungee jumping if you knew he/she is afraid of heights.”

8. Abika described its “Psychological Profiles” service specifically as follows:

“Psychological Profile report returns behavior background of a person. This can include past and current behavior and preferences. Profiles are compiled from data mining available information such as public records, behavior history records, consumer activities, demographic data, property deeds, media, public and private databases, newsgroups, opinions expressed in chatrooms, forums, message boards including other methods such as statistical comparisons with peer groups, polling and information submitted by friends, co-workers, relatives. There is no necessity to take written or verbal tests and no necessity of lengthy questions and answers as in the Myers-Briggs tests. Psychological profiles compiled from background information can surpass Myers Briggs and other psychological testing methods as they are compiled from what people do and not just what they say. Psychological profiling can help estimate personal traits and special talents that can then be verified by other facts.

“Psychological Profiling gives you an advantage in your relationships.

“Psychological Profiling reduces hiring costs, turnover and increases productivity.

“Having a lawsuit? Trial? Psychological Profiling helps you win cases and/or get the settlements you want.

“Psychological Profiling helps you find New Customers who need your protection.” ...

9. In response to her request of Abika, the original complainant received a psychological profile consisting of 30 statements attributing specific characteristics to her. The profile also included a set of six “Psych Scores”, which provided numerical ratings corresponding to such categories as “Cheating (Marriage or Romantic Relationships)” and “Leadership”.

10. According to the original complainant, the psychological profile that she received from Abika was “laughably inaccurate in a number of respects, and often bore no similarity to the person being searched”.

11. At the time of the original complaint, our Office sought and received representations from Abika. The company maintained that CIPPIC’s allegations were false and untrue, that it did not collect or maintain any databases on people, and that it was a person-to-person search engine, like Google and Yahoo, that helped people “search information through a combination of methods such as by connecting people who seek information to people who either have the information or can search the information.”

12. In subsequent representations following the reopening of the complaints, Abika flatly denied that it collected, used, or disclosed the personal information of Canadians without their knowledge and consent and reiterated that the complainant was making false and untruthful allegations. The company also suggested that, on checking any reports the complainant may have obtained through Accusearch, our Office would see that there was no private or other personal information collected or disclosed. Abika represented its psychological-profile service as being one that created “literary and artistic opinions” based on information provided by the requestor. In the original complainant’s case, according to the company, “As per her instructions the literary opinions were created [original emphasis] and obtained by her.”

13. Abika did not provide, and our Office was unable to find, any evidence of a factual basis for the psychological profile received by the original complainant. We have therefore been unable to determine to what extent, if any, the profile was based on non-public personal information about the original complainant. Nor did the complainant herself provide any objective, verifiable evidence of the profile’s inaccuracy.

14. As for other services offered by Abika, depending on the type of search ordered, the customer is asked to provide personal information of the search subject, such as name, date of birth, address, and telephone number. On the question of consent to such searches, Abika’s 2005 website stated as follows:

“If you want to conduct any searches privately and confidentially then please choose one of the paid searches. All paid searches are completely private and confidential. Only free searches require consent. When you submit a free search request, an email is sent instantaneously to the subject of the search asking for their consent to complete the search. Once the subject gives consent, the search is completed and results are sent to both the requester and the subject.”

15. In the original letter of complaint, CIPPIC maintained that Abika’s practice with respect to paid searches was in clear violation of Principle 4.3. Likewise, with respect to free searches, CIPPIC pointed out the following:

“... [T]he customer can enter any email address they wish for the search subject, and then purport to provide consent from that address. Clearly this process does not ensure that consent is obtained from the search subject: any email address can be entered, and anyone can purport to consent for the individual in question.”

16. In January 2005, our Office wrote to the U.S. Federal Trade Commission (FTC) to request its assistance in investigating the complaints. In May 2005, our Office met with the FTC to explore the possibility of sharing information. In March 2007, our Office wrote to the FTC asking for information it had collected during its own investigation of Abika.

17. The FTC subsequently provided us with a spreadsheet listing Abika’s Canadian customers – that is, requestors of information – between October 30, 2002, and July 8, 2006. The list had 668 entries, including several repeat requestors. In addition to names of requesting individuals or organizations, the entries included the requestors’ shipping addresses, dates of the requests, and status of requests, many of which were designated as “completed”.

18. There was also a column headed “Notes”, under which, in many cases, it was simply noted that the request was for monthly reports of call activities on a land line or cell-phone. In several cases, however, the notes indicated reasons for the requests. In one entry, for example, the requestor noted as follows:

“I hope this works. My x-boyfriend’s current girlfriend stole my email address and has been harassing me. I need help!”

In another, the requestor noted as follows:

“My boyfriend says that he has been working in Oaxaca, Mexico. However, I think he has returned to Madrid Spain because when I reply to his emails, I noticed that the time he sent the his [sic] email and the time I received them show a 6 hour difference...the same time difference from Madrid Spain to Toronto, Canada not from Oaxaca Mexico, I just want the truth.”

19. Although most of the requestors appeared to be individuals, some were businesses. Our Office was able to contact one such business, a Canadian paralegal firm, which the spreadsheet indicated had successfully used Abika’s services six times in 2004 and 2005. In an interview with our Office, the firm readily co-operated with our investigation and did not hesitate to answer all questions posed by us.

20. his firm acknowledged that it had used Abika’s services when a client, a private investigation company, had requested background checks on a number of individuals. The paralegal firm indicated that it had found Abika on the Internet and had filled out its request forms to get information on the individuals. The firm paid for the information by credit card.

21. According to the firm:

• Its client wanted the information in order to locate individuals suspected of being involved in the theft of satellite signals and the unlawful selling of satellite equipment in the U.S. and Canada.
• Some of the individuals in question were Canadians.
• The information requested and received included home addresses, telephone numbers, and telephone records.
• Once it received the requested information from Abika, the firm sent it on to its client, which, in turn, sent it on to its own client in the U.S.
• The information received from Abika proved not to be reliable.
• Its requests of Abika in 2004 and 2005 constituted the first and last time that the firm had been involved in what it termed an “investigative” type of activity. The firm has not used the services of Abika since that time.
• It had been somewhat naive as to the type of information requested, but now realizes that collecting such information without consent was inappropriate.

22. Through our interview with this paralegal firm, our Office has established that, in 2004 and 2005, the firm did request and receive from Abika personal information about persons living in Canada and that the firm did subsequently collect, use, and disclose this information without the knowledge or consent of the individuals in question. We are also satisfied that the firm no longer uses Abika’s services.

23. In December 2007, in a case involving the FTC against Abika, the U.S. District Court, District of Wyoming, granted a permanent injunction against Abika with respect to its obtaining and selling confidential consumer phone records without the consumer’s knowledge or consent. Abika was ordered to “disgorge” $199,692.71, and the company and its owner were ordered to comply with a number of restrictive measures for the next five years. The court also ordered as follows:

“... [That the FTC] may provide, to the extent practicable, a notice to individuals whose phone records defendants sold from February 2003 to the date of entry of this Order, informing the individuals that defendants acquired and sold their phone records, the dates defendants sold the record, and the identity of the persons to whom defendants sold the records. The notice may also provide guidance on how to respond to the disclosure or loss of sensitive consumer information, including phone records”.

24. Abika appealed the decision of the Wyoming District Court to the United States 10^th Circuit Court of Appeals. The Court of Appeals rejected each of Abika’s contentions and affirmed the judgment of the district court on June 29, 2009.

25. In May 2008, at our request, the FTC sent our Office a CD containing copies of approximately 225 documents filed by the FTC and Abika, together with court orders, in the above-mentioned U.S. District Court case (all documents were on public record in the U.S.). The documents did not contain any information specific to Abika’s Canadian-based customers or vendors (vendors being parties contracted by Abika to obtain requested phone records). However, the information was otherwise helpful in that it provided a picture of Abika’s management structure, its procedures, and its relationship with vendors and customers, and showed that Abika’s information flow was through the exchange of e-mails.

26. The documentation also provided insight into the FTC’s concerns about Abika’s disregard for acquiring a person’s consent and its failure to adequately screen requests for information. Specifically, in its court submission, the FTC stated as follows with reference to Accusearch:

“[T]he privacy concerns of the consumers whose records were ordered were not a factor in Accusearch’s screening process, even where there were clear indicia that the search subject wanted to keep his or her phone records private... . Nor were orders screened or cancelled later in the process, even when the vendor plainly indicated to AccuSearch that the search subject was taking steps to try to protect his or her phone records from disclosure. Neither Accusearch nor its vendors notified the individual search subject that someone was looking at his or her phone records, nor did they seek or receive the individual’s permission to disclose them

“Accusearch’s screening procedures did not establish whether a customer was stalking or otherwise intended harm to the person whose records were sought. ...”

27. In December 2008, again at our request, the FTC provided us with another CD containing copies of 800 pages of e-mails from Abika to its vendors from February 18, 2005 to April 4, 2006, as well as e-mails received by Abika from its vendors from July 23, 2004, to March 28, 2006, and relating to Canadian orders. According to the FTC, all of Abika’s vendors were based in the United States. The FTC further advised that it had searched for the name of the original complainant, but had been unable to find any reference to her in the data bank. It should be noted, however, that the complainant made her profile request of Abika on January 19, 2004 – prior to the earliest of the e-mails in question.

28. On review of this considerable evidence of communications between Abika and its vendors, our Office found information clearly identifying persons living in Canada by civic addresses and telephone numbers. We also found clear indications that Abika had provided this information to its vendors and requested that the vendors collect the telephone call history of the individuals. The communications also show that, in response to the e-mail requests by Abika, the vendors provided detailed information on telephone call history.

29. In one particular instance, where an individual living in Canada was the subject of six Abika requests to vendors over a two-month period, it is evident that the call history of the subject was successfully collected in five of the six cases, and that the collection was made in each case without the subject’s consent.

Application

30. In making our deliberations, we applied Principles 4.3 and 4.6 and subsection 5(3).

31. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

32. Principle 4.6 states that personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

33. ubsection 5(3) states that an organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Findings

Knowledge and Consent

34. On the question of whether Abika collected, used, and disclosed personal information of individuals living in Canada without their knowledge and consent, I have considered the following evidence:

• The e-mail documentation provided by the FTC indicates that, between February 18, 2005 and April 4, 2006, Abika made more than 100 requests of vendors for the telephone records of persons living in Canada, and received such records in response to the requests.
• The spreadsheet provided by the FTC indicates that, between October 30, 2002 and July 8, 2006, Abika took from requestors in Canada 668 orders relating to and resulting in the collection of a wide array of personal information about individuals in Canada. Moreover, in many cases, notations indicate that the orders were completed. It is further evident that much of the information collected, used, and disclosed was not publicly available and, based on the notations recorded beside several of the requests, that the information was collected without the subjects’ knowledge and consent.
• Although the court documents provided by the FTC do not specifically refer to persons living in Canada, they nevertheless provide a clear description of Abika’s general practices with regard to the collection, use, and disclosure of personal information pursuant to customer requests. In particular, the documents confirm that Abika does not make any effort to ensure the knowledge, and obtain the consent, of the individual whose personal information is requested. In the absence of evidence to the contrary, it is reasonable to assume that Abika’s practices with respect to persons living in Canada are no different from its general practices.
• Our Office’s interview with a paralegal firm has established that, in 2004 and 2005, the firm made at least six requests to Abika for personal information of individuals living in Canada, and that the firm subsequently received this information from Abika and used and disclosed it without the knowledge or consent of the individuals in all six cases.

35. On these considerations, I find that Abika collected, used, and disclosed the personal information of individuals living in Canada without their knowledge and consent, in contravention of Principle 4.3.

Accuracy

36. On the matter of accuracy, I am of the view that Principle 4.6 was intended primarily to address matters of objective, verifiable fact. The positions of the respondent and the original complainant in this regard are rather matters of differing opinion, unverified and practically unverifiable in the circumstances. I consider many of the statements in the psychological profile at issue to be highly questionable, and I would not be at all surprised if the profile proved to be partly or largely inaccurate or even fabricated. But this is, after all, only another opinion, based on the less-than-favourable general impression I have formed of Abika’s business practices in this case. Despite my suspicions, and despite my disapproval of the company’s non-consensual collections, uses, and disclosures of personal information, I have no objective factual basis upon which to find that Abika has compiled and disclosed inaccurate information about the original complainant.

Inappropriate purposes

37. On this matter, I have, in effect, already found that it was indeed inappropriate in the circumstances for Abika to have collected, used, and disclosed personal information of individuals living in Canada without their consent. Nevertheless, since the original complainant’s second allegation specifically calls the company’s purposes into question, I will address the matter as follows:

• Where collection of personal information such as non-public telephone records is concerned, it is imperative that the appropriateness of purposes be established in accordance with subsection 5(3).
• Abika has provided no evidence that it has any policy, or makes any practice, of screening requests for information according to the appropriateness of the requestors’ purposes.
• Court documents provided by the FTC convey the Commission’s concerns about Abika’s failure to screen requests in terms of the reasons why they are made, and about Abika’s apparent disregard for the safety and well-being of individuals whose personal information is collected without their consent.
• The spreadsheet provided by the FTC indicates that, in some cases, customers have requested non-public telephone records of other individuals for clearly inappropriate purposes – notably, to investigate the activities of current or former partners in a relationship.

38. On these considerations, it is my view that Abika typically accepts and fulfils requests for personal information without regard to the appropriateness of the purposes for the requests. Moreover, it is clear, that in some cases, Abika has knowingly collected, used, and disclosed personal information of persons living in Canada for purposes that a reasonable person would consider highly inappropriate in almost any set of circumstances. I find, therefore, that Abika has contravened subsection 5(3).

Recommendation and Response

39. In my preliminary report, I recommended that Abika cease collecting, using, and disclosing the personal information of persons living in Canada without their knowledge and consent. I also asked that Abika respond within 30 days of the date of the preliminary report, outlining how it intended to implement my recommendation.

40. On the 26^th day after the date of my preliminary report, I received a faxed letter from an American law firm representing Abika, requesting a 30-day extension to allow the firm to review the report and prepare a response. Given the age of the file at the time, I granted an extension of only 10 additional days up, to July 3, 2009.

41. On July 2, 2009, our Office received a telephone call from the law firm in question, requesting a further extension for the purpose of allowing Abika to engage a Canadian firm to deal with the matter. Later the same day, the American firm provided a response in writing, indicating that, since it lacked both licence and expertise in Canadian law, it was advising its client to seek legal counsel in Canada.

42. In the circumstances of this case, I did not consider it reasonable or appropriate to grant Abika any further extension of the time limit. Our Office made efforts to inform Abika of this decision both directly and through its American counsel.

Conclusion

43. I conclude that the complaint relating to accuracy is not well-founded and that the complaints relating to knowledge and consent and appropriateness of purposes are well-founded.

Other

44. efore closing, I would like to acknowledge and express our Office’s appreciation for the co-operation of the U.S. Federal Trade Commission in the course of this investigation.