Credit Bureau Purges Loan History from Individual’s Credit Report without his Knowledge

PIPEDA Report of Findings #2011-009

---

An individual complained to our Office after information relating to his history in repaying a car loan was not listed on his credit report.

The complainant had financed the purchase of a used vehicle through a third-party financing company. In financing the purchase of his vehicle, he sought a lender that reported to a national credit bureau. He did so in the belief that a positive repayment history might help augment his overall credit standing.

Following the repayment of his car loan, the complainant sought to take advantage of a provincial program providing grants to qualified applicants towards the purchase of a home. The complainant appeared to have obtained a mortgage pre-approval from a mortgage broker conditional upon qualification for the grant.

According to the complainant, after receiving notice of acceptance for the grant, he returned to the mortgage broker with whom he had been conditionally pre-approved, only to be advised that he no longer qualified for the loan.

Although the reasons supporting the complainant’s denial of credit could not be determined with certainty, it was the mortgage broker’s belief that the absence of the generally positive car loan history may have harmed the complainant’s credit score.

According to the credit bureau, it was the company’s policy to stop reporting any information from a data source with which it did not have an ongoing relationship (“a severed data source”) approximately 60 days after its relationship with a data source ended. The credit bureau asserted this policy was necessary to ensure that information provided in its credit reports remained accurate, complete and up-to-date.

Given that the credit bureau is engaged in the collection, use and disclosure of personal information for commercial purposes, we asserted jurisdiction to investigate the complaint. Our investigation focused primarily on the credit bureau’s obligations to ensure the accuracy and completeness of the complainant’s credit file. We also considered matters relating to openness.

The credit bureau produced sufficient evidence to demonstrate how reporting information from a severed data source might adversely affect the integrity of its credit reports. (Although the effects in this case of the purging of loan information were such that it rendered his credit history incomplete, we could envision other scenarios in which not purging information from a severed data source might have led to an equally inaccurate or incomplete credit picture.)

We found the complaint to be not well-founded on the matter of accuracy.

At the time of our investigation, the credit bureau did not publicly disclose its 60-day retention policy for information from severed data sources.

Had the complainant been aware of the credit bureau’s 60-day policy, he may have been in a better position to monitor his file and to consider placing a narrative on his credit report. As well, he may have obtained information directly from the severed data source in a timely manner in order to supplement his credit record.

As PIPEDA requires that an organization make readily available to individuals specific information about its policies and practices relating to the management of personal information, and so far as the credit bureau failed to be open with the complainant about its policy on severed data sources, we found the complaint to be well founded.

The credit bureau agreed to implement our Office’s recommendations to address this issue.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (PIPEDA or the Act)

1. The complainant alleges that a credit bureau failed to ensure the accuracy and completeness of his personal information. More specifically, the complainant has alleged that information relating to his car loan history with a third-party lender was deleted from his credit report by the credit bureau, without his knowledge or consent. The complainant further alleges that he was subsequently denied credit from other lenders on account of having an incomplete and inaccurate credit report.

Facts

2. In 2004, the complainant financed the purchase of a used vehicle through a financing company. In financing the purchase of his vehicle, the complainant sought a lender that reported to a national credit bureau. He did so on the belief that a positive repayment history might help augment his overall credit standing. Indeed, at the time the complainant’s loan was extended, the financing company was said to have been actively advertising its services as “credit rebuilding”.

3. The complainant began repaying his car loan in 2004. By 2008, the complainant’s loan was paid in full.

4. In 2008, following the repayment of his car loan, the complainant sought to take advantage of a provincial housing grant program. The program in question provided grants of up to $50,000 to qualified applicants towards the purchase of a home. The complainant alleges that he obtained a mortgage pre-approval from a mortgage broker conditional upon qualification for the grant.

5. According to the complainant, upon receipt of notification of acceptance of the grant, he returned to the mortgage broker with whom he had been conditionally pre-approved, only to be advised that he no longer qualified for a loan.

6. Although the reasons supporting the complainant’s denial of credit could not be determined with certainty – lenders and financial institutions having right to their own criteria for loan approval – the mortgage broker in question informed our Office that credit information relating to the complainant’s car loan with the financing company was noticeably absent from the complainant’s credit history. It was the mortgage broker’s belief that the absence of the complainant’s car loan history may have been detrimental to the complainant’s credit score. In his view, the complainant’s loan with the financing company, which showed a generally positive repayment history, might have helped in part to re-establish the complainant’s credit rating. It was his understanding that the complainant’s credit score had dropped significantly from the time at which the complainant had been pre-approved for a mortgage, to the time at which the complainant had qualified for the grant.

7. Given the number of factors affecting credit ratings, we were unable to qualify the extent to which the complainant’s credit score may have been altered by the loss of car loan information. Our review of the complainant’s credit file in 2007 and 2009 did however corroborate the fact that car loan information related to the financing company, once listed on the complainant’s credit report, was later missing.

8. Upon investigation, it was revealed that although the financing company was indeed reporting the complainant’s payment history to the credit bureau on a monthly basis, in or around June 2007, prior to the settlement of the complainant’s loan, credit reporting to the credit bureau ended. We further confirmed that in or around August 2007, the company terminated its credit reporting relationship with the credit bureau, and that upon termination of this relationship, the credit bureau proceeded to delete all payment history relating to the company from the credit reports of individuals, including that of the complainant. At the time that the financing company terminated its relationship with the credit bureau, the company had over 1,500 active accounts.

9. According to the credit bureau, it is the company’s policy to stop reporting any information from a data source with which it does not have an on-going relationship (i.e., “a severed data source”) approximately 60 days after its relationship with a data source ends. This policy has the effect of purging the entire portfolio of information associated with a severed data source – whether positive or negative – leaving no trace of credit history on an individual’s file. According to the credit bureau, this policy is necessary to ensure that information provided in its credit reports remains accurate, complete and up-to-date.

10. At the time of our investigation, the credit bureau did not publicly disclose its 60-day retention policy for information from severed data sources. The company’s data retention policy, as disclosed on the complainant’s credit report, and as pertaining to “credit history and banking information”, stated that: “A credit transaction will automatically purge from the system six (6) years from the date of last activity”.

11. While the financing company offered to provide the complainant with a letter reflecting his payment history with the company, the complainant alleged that lenders associated with the provincial housing grant program, with which the complainant was seeking a mortgage, were unwilling to accept such a note.

12. Upon learning that his car loan history had been purged by the credit bureau, the complainant filed a complaint with the provincial Consumer Protection Branch, which oversees and investigates consumer complaints relating to the province’s Consumer Reporting Act. The Consumer Protection Branch, along with the province’s Financial Services Commission investigated the actions of the credit bureau and the financing company in 2009.

13. In addressing the concerns of the complainant, the Consumer Protection Branch is said to have focused its investigation on the reasonableness of the credit bureau’s policy regarding severed data sources. It also considered the means by which to best balance the interests of consumers and the credit bureau industry.

14. In concluding their investigation, the Consumer Reporting Branch held that the credit bureau’s policy regarding severed data sources was, on the whole, reasonable. While it was not clear to the Branch whether the reporting of incomplete loan information on the complainant’s credit file would have been of benefit to the complainant – since incomplete information may have been duly disregarded by a lender – it found that the deletion of information relating to a severed data source was a reasonable measure to ensure the accuracy and completeness of credit files.

15. The Consumer Protection Branch also held that the credit bureau’s invitation to the complainant to post a short statement to his credit file describing missing information was sufficient in meeting the company’s requirements to ensure the integrity of credit files under provincial consumer reporting regulations. The credit bureau provides all consumers with the opportunity to add a narrative to their credit file at any time by contacting the company.

16. We note that the complainant rejected the offer to add a narrative statement to his file, being of the belief that any self-annotation to his report was likely to be disregarded by lenders.

17. Following the decision of the Consumer Protection Branch above, the complainant filed a privacy complaint with our Office.

Analysis and Findings

November 22, 2011

Jurisdiction

 

18. Our Office first notified the credit bureau of the complaint against it October 2009. The credit bureau responded to our notice of investigation in November 2009 by claiming that the Privacy Commissioner did not have jurisdiction to investigate.

19. In a series of correspondence beginning thereafter, our Office re-asserted jurisdiction over the complaint and provided the credit bureau with further details concerning the complainant’s allegations. We also directed the company to various privacy principles which we believed applied to the facts of the case.

20. In February 2010, the credit bureau again responded with a statement challenging the Commissioner’s jurisdiction to investigate. According to the credit bureau, the Commissioner lacked jurisdiction to conduct an investigation into the complaint where, in its view:

• the Act applied only to the personal information an organization handles (and not to information an organization does not handle);
• the Act does not impose requirements that restrict an organization’s ability to delete data it does not intend to use, beyond requiring that it be done securely; and where
• general practices relating to the content of credit reports fall outside of the Act’s scope, being regulated instead by provincial credit reporting acts.

21. In May 2010, after further review, our Office once again asserted jurisdiction to investigate the complaint and asked the credit bureau for representations in response to the complainant’s allegations.

22. In June 2010, without ceding its argument on jurisdiction, the credit bureau began providing information about its policies and practices concerning severed data sources in a manner sufficient so as not to impede our investigation.

Application and Finding

Credit reporting agencies

23. In considering the Commissioner’s jurisdiction to investigate, we first looked to subsection 4(1)(a) of the Act. Subsection 4(1)(a) states that Part 1 of the Act (Protection of Personal Information in the Private Sector) applies to every organization that collects, uses or discloses personal information in the course of commercial activities.

24. As organizations engaged in the collection, use and disclosure of personal information for commercial purposes, credit reporting agencies have long fallen under the Act in the same manner as other private-sector organizations. Although the Act may not apply in instances where an organization is operating in a province with substantially similar legislation, organizations engaged in trans-border activity are generally subject to federal law. Indeed, our Office has investigated numerous complaints against credit reporting agencies since January 2004, including complaints concerning this credit bureau.

25. In this instance, where the credit bureau is involved in the collection, use and disclosure of personal information for commercial purposes, we find the company to be subject to the Act.

Information an organization no longer collects, uses or discloses

26. It is the credit bureau’s contention that the Act only applies to the personal information an organization handles (rather than the personal information that an organization does not handle). We respectfully disagree. In our view, such a contention reflects a mischaracterization of the facts of this case and an oversimplification of the spirit and operation of the Act.

27. The case at hand concerns the deletion of personal information from the complainant’s credit history – information that the credit bureau had collected, used and disclosed. While at the time of our investigation the credit bureau was no longer in possession of that information, it remained responsible for the handling of the complainant’s credit file. It is therefore misleading to characterize the complaint as one concerning information that the credit bureau no longer handles. It is also incorrect to suggest that the Act does not apply to information that an organization no longer has in its possession. Such an interpretation would allow organizations to evade the provisions of the Act by simply deleting personal information under their control.

28. While subsection 4(1)(a) provides that the Act only applies to personal information that an organization collects, uses or discloses in the course of commercial activities, this provision must be read in concert with other obligations relating to the retention and deletion of information, sufficient to give meaning to the privacy principles underscoring the Act. Just because an organization has ceased to collect, use or disclose a particular type or set of personal data does not mean that it can no longer be the subject of a complaint concerning past collection, use or disclosure.

29. In our view, the termination of the reporting relationship between the financing company and the credit bureau does not allow the credit bureau to escape its obligations under the Act relating to information previously provided by the financing company. The credit bureau’s duty to ensure the proper handling of personal information is a positive duty outlasting its relationship with other parties. Nor does it allow the company to disregard its responsibilities under the Act in relation to personal information still under its control.

30. In so much as the credit bureau continues to maintain the personal information of the complainant for credit reporting purposes, and where the company had previously collected, used and disclosed the complainant’s loan history from the financing company, it remains within the jurisdiction of this Office to investigate the present complaint.

Obligations under provincial credit reporting acts

31. The credit bureau contends that its practices pertaining to the content of credit reports fall outside of the scope of the Act (and thus the purview of this Office), being regulated instead by provincial credit reporting laws. While the credit bureau is correct in noting its obligations under credit reporting or consumer protection legislation, in our view the application of those laws do not necessarily affect the company’s status under PIPEDA.

32. In our view, PIPEDA may at times impose obligations concerning the handling of personal information in addition to those created by provincial statutes. In some cases, an organization’s adherence to other laws may be sufficient in achieving compliance with the Act. Indeed, the Act expressly contemplates that certain organizations may already be regulated in ways that impact their obligations under PIPEDA.In other instances however, an organization’s obligations under other federal or provincial laws may not fully exhaust an organization’s responsibilities under the Act.

33. In the case at hand, we note that while the content of credit reports may be dictated in part by the province’s Credit Reporting Act, the credit bureau’s treatment of personal information as contained therein is still subject to the privacy principles underscoring PIPEDA. Accordingly, we find the credit bureau’s statement that the subject of this complaint is outside the purview of this Office to be incorrect. We note that our Office has investigated (and continues to investigate) complaints against credit reporting agencies for a variety of matters relating to the handing of personal information held in credit files.

34. In so far as the credit bureau remains subject to the Act, its personal information handling practices must abide by the Act’s principles. As such, we continue to assert jurisdiction over the present complaint.

Complaint

35. At issue is whether the credit bureau’s policy to delete the complainant’s personal information, as relating to his car loan history with the financing company – which had discontinued its reporting relationship with the credit bureau in August of 2007 – contravened the Act.

Summary of Investigation

36. Our investigation focused primarily on the credit bureau’s obligations to ensure the accuracy and completeness of the complainant’s credit file. We also considered matters relating to openness. To this end, we closely reviewed the credit bureau’s policies and practices surrounding severed data sources, taking into account the company’s obligations under provincial credit reporting and consumer protection acts.

37. Provincial rules surrounding the content and integrity of credit reports are set out in the province’s Credit Reporting Act. One section of this Act states that a credit agency shall not include in its credit reports “any information not based on the most reliable evidence reasonably available”. Another section goes on to say that every credit reporting agency shall ensure that records are made “complete and accurate” in respect of the information to be disclosed by law.

38. According to the credit bureau, in order to ensure the completeness and accuracy of information in its credit reports, the company has put into place controls geared at protecting the integrity of credit information. One such control lies in the contractual obligations that the credit bureau imposes on its data sources or credit grantors. According to the credit bureau, credit grantors reporting to the company must observe specific reporting standards ensuring the accuracy and completeness of data reported. These reporting standards require that credit grantors:

1. submit information about their entire portfolio, both “positive” and “negative” to the credit bureau for reporting;
2. update all account information regularly, and at a minimum monthly; and
3. investigate, upon request, any information disputed by an individual (promptly responding in writing to confirm or correct information in dispute).

39. In addition to the above, it is the company’s policy to stop reporting data from severed data sources in the credit files of individuals approximately 60 days after its relationship with a data source ends. As per the credit bureau, in the absence of an on-going relationship with a data provider, it can no longer reasonably keep an individual’s credit information complete and accurate, as required by law.

40. According to the company, if it were to continue to report information about an account after the end of its relationship with a data source, it would be unable to update the account to reflect credit events which might transpire after a data source had been severed. Subsequent events which might not be recorded to an individual’s credit account might include:

• loan payments by individuals, whether made or missed;
• changes to the amounts of credit granted to an individual;
• changes to balances owed by the individual to severed data sources;
• account closings by the individual or institution;
• settlements of delinquent accounts by the individual.

41. In its representations to our Office, the credit bureau stressed that information about an individual’s credit standing is rarely static. Seemingly positive credit information can quickly become negative information, and negative credit information can quickly become positive.

42. In most cases, changes to information in an individual’s credit file can lead to changes in his or her credit score. To this point, we note that information used to determine an individual’s credit score (as disclosed on the credit bureau’s external website) is for the most part dynamic (i.e., subject to frequent and periodic change). Examples of information used in credit scoring and subject to change include:

• whether an individual has made loan payments on time;
• amounts owing and credit limits with various lenders;
• the length of time an individual has had credit;
• how often an individual seeks new credit and how accounts recently opened are being handled; and
• the types of loans individuals have.

43. While our Office inquired about the benefits of ensuring that at minimum positive credit information was retained on file in the event of a data severance, the credit bureau was emphatic in underscoring the importance of data continuity in ensuring the accuracy of credit reports. In its view, differentiations between positive and negative information are but qualitative descriptions of facts related to an account that can (and often do) change over time. As per the credit bureau: “...an account that is in good standing on the date [its] relationship with a data source ends, could become overdue the next day, and vice versa”.

44. To this point, it offered several illustrations of how the absence of an on-going relationship with a data source might affect the accuracy of an individual’s credit report. In particular, we considered the example of a consumer with a $10,000 line of credit who has utilized $5,000 worth of that credit at the time at which the credit bureau’s relationship with the data source (or credit provider) ends. If the credit provider ceases to report on-going loan information to the credit bureau, and if all information relating to the credit provider is not deleted from the consumer’s file, as per the credit bureau, the credit information to be reported would indicate an outstanding balance of $5,000 – even though the consumer may have fully repaid the balance owing following the end of the credit bureau’s relationship with the credit provider. According to the credit bureau, that information may adversely affect an individual’s ability to borrow.

45. Based on the above, and in keeping with its legal obligations to ensure the accuracy of credit reports, the credit bureau does not distinguish between positive and negative information in its data retention policy for severed data sources. All data associated with a severed data source is deleted from the records of individuals once the company’s relationship with the data source is terminated. It is the credit bureau’s view that its policy on severed data sources is necessary to ensure compliance with both provincial credit reporting statutes and the Act.

46. Notwithstanding the above, and other standard industry practices in place to ensure the accuracy of its data reporting, the credit bureau maintains that it has no bearing on the lending practices or decision making processes employed by credit grantors.

Application

47. In making our determinations, we applied Principles 4.5.2, 4.6, 4.6.1, 4.8 and 4.8.1 of Schedule 1 of the Act.

48. Principle 4.5.2 states that organizations should develop guidelines and implement procedures with respect to the retention of personal information. It goes on to say that personal information that has been used to make a decision about an individual shall be retained long enough to allow the individual access to the information after the decision has been made. Notwithstanding the above, we note that an organization may be subject to other legislative requirements with respect to retention periods.

49. Principle 4.6 deals with the accuracy of personal information. It states that personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used. Principle 4.6.1 states that the extent to which personal information shall be accurate, complete and up-to-date will depend upon the use of the information, taking into account the interests of the individual. It goes on to say that information shall be sufficiently accurate, complete and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.

50. Finally, we considered Principle 4.8. It states that an organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information. According to Principle 4.8.1, organizations must be open about their policies and practices with respect to the management of personal information. Individuals shall be able to acquire information about an organization’s policies and practices without unreasonable effort.

Analysis and Finding

51. As previously stated, it is the credit bureau’s policy to cease reporting any information from a data source with which it does not have an on-going relationship approximately 60 days after its relationship with a data source ends. This policy has the effect of purging the entire portfolio of information associated with a severed data source – whether positive or negative – leaving no trace of credit history on an individual’s file.

52. The credit bureau strongly believes that this policy is necessary to ensure that the credit information provided in its reports remains accurate, complete and up-to-date. To this point, it has brought sufficient evidence to demonstrate how reporting information from a severed data source might adversely affect the integrity of its credit reports, given that credit information is constantly in flux. Notwithstanding the effects of the purging of the financing company information from the complainant’s credit report in this case, one could envision an equal number of other scenarios in which a failure to purge information from a severed data source might have led to an equally inaccurate or incomplete credit picture.

53. Principle 4.6 states that personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used. As stated in its privacy policy, the credit bureau uses consumers’ financial and credit information in order to provide its customers with credit reports that show consumers’ recent credit history. By continuing to disclose information in a consumer’s credit file from a data source that has long been severed, the credit bureau might not be presenting information in its reports that is recent and up-to-date. As previously stated, an account that is in good standing one day can become overdue the next day (or vice versa).

54. Absent continuity in the reporting relationship with a data source, the credit bureau appears unable to ensure that the information in its credit reports is recent, reliable and up-to-date. Not only would the credit bureau be unable to report on subsequent changes to an individual’s credit report, the company would also be unable to verify and investigate inaccuracies in data reporting.

55. By presenting potentially outdated or incomplete information, the credit bureau could increase the possibility that inappropriate information is used to make a credit decision about an individual, contrary to the requirements of Principle 4.6.1. As such, we do not find that the credit bureau contravened the Act by deleting the complainant’s financing company car loan information. We therefore find the complaint to be not well-founded on the matter of accuracy.

56. Notwithstanding the above, we find it concerning that credit information was entirely purged from the complainant’s credit file, without his knowledge. In this case, not only was the complainant completely unaware that his personal information was to be deleted, third-parties who might have relied on the company’s credit reports for lending appear to have been similarly unaware of the company’s policies and practices.

57. When its relationship with a data source ends, the credit bureau is no longer in a position to receive updates on information affecting an individual’s credit score. In this regard, the purging of personal information relating to a severed data source helps to ensure some measure of integrity of credit data still on file. If properly advised of this practice, an individual affected by a severed data source would know to update his or her report, and or to take action to obtain information directly from the severed data source in a timely manner so as to supplement his or her credit record.

58. A per Principle 4.5.2, where personal information is used to make a credit-related decision about an individual, that information must be retained long enough so that the individual can access it. In our view – and in recognition of the importance of data continuity in credit reporting – the company’s 60-day retention period for information from severed data sources is sufficient so as to allow an individual to gain access to his or her credit file for correction. To this point, we note that the company’s policy is consistent with that of other Canadian and North American credit reporting agencies.

59. At issue is not whether the company’s retention policy for information from data sources was sufficient, but whether the company fulfilled its responsibility to adequately disclose its practices and policies regarding severed data sources to the complainant.

60. Principle 4.8.1 requires that organizations be open about their policies and practices with respect to the management of personal information. Accepting the merits of the credit bureau’s policy vis-à-vis severed data sources, it is our view that the company’s practices concerning severed data sources ought to have been publicly disclosed. Indeed, given the number of individuals potentially affected by such a practice, we would have expected this practice to have been disclosed in both the company’s privacy policy and in communications with individuals and lenders.

61. Absent any disclosure of its practices and policies concerning severed data sources, individuals and lenders alike are left with the impression that information from a severed data source remains in a consumer’s credit file in accordance with the credit bureau’s general retention policy. Whereas the company’s present data retention policy states only that: “a credit transaction will automatically purge from the system six (6) years from the date of last activity”, consumers may not be aware that information from their credit reports may in fact be deleted much sooner where a data sources stops reporting to the credit bureau.

62. Had the complainant been aware of the credit bureau’s policy, he may have been in a better position to monitor his file and to consider placing a narrative on his credit report. While we accept that the addition of a consumer narrative may be a reasonable manner in which to ensure that credit files affected by severed data sources remain as accurate and complete as possible (see Case Summary 2003-157), the provision of a consumer narrative alone is insufficient in meeting the company’s obligations under the Act.

63. Where Principle 4.8 requires that an organization make readily available to individuals specific information about its policies and practices relating to the management of personal information. And where the credit bureau failed to be open with the complainant about its policy on severed data sources, we find the complaint to be well founded on the matter of openness.

Recommendations

64. Where the credit bureau is not currently meeting the requirements of the Act with respect to openness, we have recommended that the company update and publish its retention policy for personal information from severed data sources.

65. In particular, we have asked the credit bureau to:

1. Revise its Privacy Policy to incorporate a statement regarding its 60-day retention period for information from severed data sources in order to assist individuals in understanding and monitoring their credit reports. The revised policy should be placed on the credit reports of all individuals and should refer readers to further information which, among other matters, plainly informs stakeholders of the potential effects of severed data sources on consumer credit reports;
2. Revise and update member contracts, in time, so as to better inform and instruct lenders as to the limitations of the company’s credit reports where a data source has been severed;
3. Inform and instruct its members of the effects that a decision to cease reporting credit information may have on consumer credit files.

66. The credit bureau has agreed to begin implementing these recommendations immediately. In keeping with technical implementation requirements, the company expects changes to be released by April 1, 2012. Our Office has agreed to follow-up on the implementation of the above, following which the issues in this report will be deemed resolved.

Other

67. While the application of the Act does not, in our view, create upon credit agencies an obligation to reflect in credit reports personal information from severed data sources, this investigation brings to light the need to further examine the best interests of individuals in relation to the accuracy of credit reports in the face of data severances. With that view, our Office will seek to include this matter in its second review of the Act.