Organization could reasonably assume customer's implied consent for disclosure in dispute resolution situation

PIPEDA Report of Findings #2014-013

October 31, 2014

---

A complainant alleged that his Internet service provider (ISP) had disclosed his personal information without his consent to a newspaper columnist, from whom the complainant had asked assistance in resolving a longstanding service dispute he had with the ISP.

The newspaper columnist was a consumer advocate who intervened in, and tried to resolve, problems that individuals were experiencing with various businesses. Typically, the columnist would then publish an article in the newspaper and on a Web site about the matter, identifying the assisted consumer by name. The columnist and the newspaper were well known to the complainant and he had contacted the columnist before regarding other consumer matters.

When the newspaper columnist received the complainant's email containing an instruction to resolve his dispute with the ISP, as well as a description and history of it, the columnist forwarded the complainant's email to the CEO of the ISP. The CEO wrote back to the columnist and relayed his version of the facts of the complainant's complaint history with the ISP.

The columnist then forwarded the CEO's response back to the complainant. The complainant objected to the ISP having shared his personal information with the columnist, alleging that he had not provided his consent for this to occur and stated that he had not anticipated the columnist contacting the ISP. He thus filed a complaint against the ISP with our Office.

For its part, the ISP believed that it had the implied consent of the complainant to disclose his personal information required to investigate his complaint and to respond to the columnist. The ISP pointed out that all the personal information it disclosed was related to the complaint and was relevant to defending itself against the complainant's allegations.

After reviewing the evidence, our Office was satisfied that the personal information disclosed in this context was not sensitive, pursuant to Principle 4.3.6 of PIPEDA. Our investigation concluded that in the specific circumstances, a reasonable expectation of the individual would be the possibility of a disclosure of his personal information (which he himself had put at issue when he contacted the columnist for assistance) so that the information could be shared between the two other parties in an effort to resolve his complaint. The complainant was obviously familiar with the consumer advocacy work carried out by the columnist as he had had previous dealings with her and regularly reads the newspaper in which her columns are published.

Noteworthy in this case is that the CEO of the ISP would have also seen the complainant's email to the columnist, in which the complainant clearly asks the columnist to resolve the dispute for him and freely provides the columnist with his personal information. Consequently, the CEO could have reasonably inferred the complainant's implied consent for the CEO to disclose to the columnist the complainant's personal information relevant to the complaint. Furthermore, the ISP limited itself to only providing personal information relevant to the matter put at issue by the complainant.

Therefore, the matter was found to be not well-founded.

REPORT OF FINDINGS

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act” or “PIPEDA”)

Overview

A customer of an Internet service provider ("ISP") had been complaining to the ISP about his residential Internet speed for several years. When he felt he was receiving conflicting information, he contacted a newspaper columnist for assistance in resolving the issue. After the ISP disclosed some of his personal information to the columnist in their attempt to resolve his complaint, he objected on the grounds that he had not provided his consent for such a disclosure.

The ISP claimed that the customer provided his implied consent for the disclosure when he contacted the columnist about his concerns. It also claimed that any personal information provided to the columnist was entirely related to the complaint and relevant to conducting its defence.

Our Office found that there was enough evidence to support the ISP's contention of assuming the customer's implied consent and that only relevant information was disclosed by the ISP. We thus determined that the matter was not well-founded.

Summary of Investigation

1. The respondent (the "ISP") is a provider of telecommunication services including residential Internet products to subscribers. According to the respondent, the complainant has been one of its customers for several years, subscribing to a high-speed Internet connectivity product ("the product"). For the product, the respondent claims maximum speeds of connectivity, the transmission of which depends on the telephone lines belonging to the local telephone company serving the subscriber's area.
2. The complainant complained to the ISP about what he claimed was slow Internet service speeds he received at his residence. Similar concerns had been expressed by the complainant to the ISP in the past. The ISP reviewed the issue again with the complainant's local telephone company, who determined that the speeds of the Internet received at the complainant's residence was reduced because of the length of the service line between his residence and the equipment servicing it.
3. However, the complainant then reported to the ISP that he received conflicting information about the service line, conveyed to him by a telephone company technician working in his neighbourhood. Numerous emails were exchanged.
4. During these email exchanges, and on two different occasions, the complainant informed the ISP that he would be informing and involving the government and the media regarding the issues he was facing.
5. Shortly thereafter, the complainant sent an email to a columnist with a daily newspaper in his city, who has a regular column dedicated to consumer complaints made against various businesses, as well as maintaining a similarly oriented Web site. The columnist has been known to intervene to resolve consumer complaints whereby the columnist then publishes a summary of each case, including the customer's name and the eventual outcome. The complainant has acknowledged to our Office that he reads that newspaper daily, that he was familiar with the columnist's work and that he had prior contact with the columnist regarding other matters and other businesses.
6. In the complainant's email to the columnist, he explained that he had been complaining to the ISP for two years about his upload speed, that he received line length information from his local telephone company and how that information contradicted information he received from the ISP, and that he objected to having to pay the ISP's entire monthly Internet service fee. At the end of his email, he stated to the columnist that he hoped she now had enough information to finally resolve the matter.
7. The next day, the columnist forwarded the complainant's email to the chief executive officer (the "CEO") of the ISP, along with the columnist's very brief summary of the reported problem.
8. The following day, the ISP's CEO replied to the columnist. In the CEO's email, he provided a description of the complainant's longstanding complaint history about his internet speed; the ISP's responses to past Internet speed issues raised by the complainant and; the decisions made by the complainant with respect to service alternatives that the ISP had offered him. The CEO also very briefly and in general terms described his perception of the downward trend, over time, of the complainant's demeanor when dealing with the ISP's customer care staff.
9. The CEO's email was forwarded to the complainant by the columnist three days later. The complainant objected to the ISP sharing his information and he sent a letter to the ISP in which he alleged there had been a privacy breach. The complainant listed several conditions to avoid the escalation of the matter, including receiving continued Internet service from the ISP and financial compensation.
10. The complainant then filed a complaint against the ISP with our Office, which we accepted. In his complaint, he alleges that the respondent disclosed to the columnist his personal information without his consent, specifically his account relationship and customer service/technological support history.
11. Moreover, to our Office, he has stated that the information that the ISP provided to the columnist was released in an abusive and bad faith manner, and in an effort to defame and discredit him.
12. The complainant's position is that he was never asked, by either the ISP or the columnist, for consent to disclose any of his personal information and/or private information held by the ISP, and that at no time did he ever provide such consent. The complainant contends that, at the time, he was unaware that the columnist would be contacting the ISP in the columnist's follow up to his complaint.
13. The respondent's position is that it reasonably believed that it had the implied consent to disclose the personal information needed to properly investigate the complaint and to respond to the columnist. In the respondent's view, the information it provided to the columnist was entirely related to the complaint and was necessary to best convince the columnist that this was a matter that should not be pursued in the columnist's regular column, given the context. The respondent also asserted that the complainant's personal information disclosed was limited to what was relevant to conducting the respondent's defence.
14. During our investigation, our Office reviewed copies of all the emails mentioned above that were sent by the complainant, the columnist and the ISP.
15. To this day, the columnist has not reported on the complainant's conflict with the ISP in the newspaper column. Instead, the columnist informed the complainant personally that there was nothing that the columnist could do for him.
16. Lastly, we noted that the complainant also submitted a complaint about the matter to the Commission for Complaints for Telecommunication Services, which closed the complaint, noting that no further investigation was warranted.

Application

17. In making our determinations, we applied Principles 4.3, 4.3.5 and 4.3.6 of Schedule 1 of the Act.
18. Principle 4.3 requires the knowledge and consent of the individual for their collection, use or disclosure of personal information, except where inappropriate.
19. Principle 4.3.5 states that in obtaining consent the reasonable expectations of the individual are also relevant.
20. Principle 4.3.6 states in part that the way in which an organization seeks consent may vary, depending on the circumstances and the type of information collected. Implied consent would generally be appropriate when the information is less sensitive.

Findings

21. At issue in the first place is whether the ISP had the complainant's consent to disclose to the newspaper columnist information about him relevant to his complaint about his Internet service. Knowledge and consent are required under Principle 4.3, except where inappropriate.
22. The complainant contends that he was unaware that the columnist would be contacting the ISP to follow up his complaint and that he had not provided consent to the ISP.
23. To begin, PIPEDA sets out two types of consent — express and implied — and recommends, in accordance with Principle 4.3.6, that express consent be sought in general when the personal information at issue is likely to be considered sensitive and that implied consent is generally appropriate when the information is considered less sensitive.
24. We have reviewed the personal information that the ISP disclosed (namely the history of the complainant's dispute with the ISP) and do not consider it sensitive in the context in which it was provided.
25. Also on this subject, our Office has published a fact sheet, Determining the appropriate form of consent under the Personal Information Protection and Electronic Documents Act^{Footnote 1}. The fact sheet explains that implied consent covers situations where the intended use or disclosure is obvious from the context and the organization can assume with little or no risk that the individual, by providing the personal information, is aware of and consents to the intended use or disclosure. Where circumstances indicate that an individual has a certain understanding, knowledge, or acceptance, or certain information has been brought to the attention of an individual, consent might be implied. Citing the CSA Model Code: "Implied consent arises where consent may reasonably be inferred from the action or inaction of the individual".
26. After close consideration of the facts, we are of the belief that, by his actions, the complainant gave his implied consent for the columnist to contact the respondent and for the respondent to disclose the necessary information to respond to allegations made against it and to assist in efforts to resolve the matter.
27. Firstly, the complainant himself clearly put his information at issue when he contacted the columnist so that the columnist could assist him in resolving the issue with the ISP. Specifically, in his email to the columnist, he chose to include numerous details about the conflict between him and the ISP, as well as to express his desire for the columnist to finally resolve the matter.
28. Further, since he had corresponded with the columnist before and read the column, the complainant was obviously familiar with the consumer advocacy work the columnist undertakes, which is published in a newspaper that the complainant states he regularly reads.
29. Moreover, it is our view that, from the ISP's perspective, the complainant's implied consent for the ISP to disclose relevant information could have been reasonably inferred. It could be assumed, from the content of his email to the consumer-advocate columnist, that the complainant was leaving his case against the ISP in the columnist's care. It is important to note that the CEO of the ISP would have seen firsthand this email, in which the complainant clearly seeks resolution and provides his personal information to the columnist.
30. Thus, in these specific circumstances, a reasonable expectation of the individual (i.e., the complainant) would be the possibility of a disclosure of his personal information so that it could be shared between the two other parties involved in his complaint resolution.
31. Implied consent does not give organizations carte blanche to collect, use or disclose all personal information. Thus, our Office also considered whether the complainant's personal information that was disclosed in this case was relevant to his complaint against the ISP.
32. The information disclosed in this case consisted of a description of the complainant's complaint history; the ISP's previous responses; its efforts to satisfy the complainant; the decisions made by the complainant with respect to service alternatives offered to him and; the complainant's demeanour when dealing with the ISP's customer care staff. A portion of this information had already been provided to the columnist by the complainant himself in his email to the columnist.
33. After careful review, we are of the mind that the respondent limited itself to only providing the information needed to respond to the allegation.
34. For the above reasons, there was implied consent and Principles 4.3, 4.3.5 and 4.3.6 were not contravened.
35. Further, we consider that the respondent mentioning, in objective terms, the demeanour of the complainant to the columnist was relevant information in this case since it explains the ISP's reasoning for business decisions it took (e.g., the escalation of the complainant's concerns at one point) and provides context to the customer-business relationship and how the relationship evolved over time relative to the customer's longstanding complaint about slow Internet speeds.

Conclusion

36. Accordingly, we conclude that the matter is not well-founded.

Footnotes