Collection agency can't refuse access to personal information on basis that it would be provided as part of a legal proceeding

PIPEDA Report of Findings #2014-017

December 30, 2014

---

The complainant alleged that a debt collection agency refused a request to provide him with access to his personal information. The complainant further alleged that the agency had shared his personal information with a third party without his knowledge or consent.

The complainant, who was living in Europe at the time, incurred a credit card debt in 1999. After moving to Canada, he continued to make regular payments on the account until he believed the balance had been reduced to zero. The European bank that issued the credit card believed there was still a balance outstanding. The complainant refused to pay and, in 2011, the outstanding debt was ultimately referred to a collection agency with offices in Canada. The complainant continued to dispute the debt and filed a legal action against the collection agency in Canada. To support his case, he asked the collection agency for access to his personal information. The collection agency refused to provide the complainant with access to his personal information, basing its refusal on the assumption that, since it would be disclosed to him as a part of the legal action, it had no obligation to do so.

The collection agency confirmed to our Office that it had refused the complainant's access request. Our Office advised the collection agency that, under the Act, it is obliged to provide access to an individual's personal information, even if the information would be provided anyway as part of a legal proceeding. The collection agency subsequently provided the complainant with access to his personal information. The complaint was therefore well-founded and resolved.

Subsequent to filing the complaint, the complainant further alleged that the collection agency had disclosed his personal information without his consent when it exchanged information with a credit reporting agency, as well as the fact that the European bank disclosed his personal information to the collection agency. While the Act states that the knowledge and consent of the individual is required for the collection, use, or disclosure of personal information, it also includes some exceptions. Paragraph 7(3)(b) of the Act specifically states that an organization may disclose personal information without the knowledge or consent of the individual if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

REPORT OF FINDINGS

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”) or “PIPEDA”

Summary of Investigation

1. The complainant, a resident of Canada, was living in Europe when he incurred a credit card debt in 1999. When he moved to Canada, he continued to make regular payments on the debt through a bank located in Europe.
2. Eventually, the complainant made what he thought was his last payment. However, the bank in Europe believed that there was still an amount owing. Consequently, it considered the complainant's account to be in default and, in 2011, the bank in Europe referred the debt for collection.
3. Ultimately, the debt was referred to one of the U.S. offices of a law firm specializing in debt recovery, and then in April 2012 to a collection agency with offices in Canada (the "agency"). The agency duly informed the complainant that it was acting as the authorized agent for the law firm and the bank in Europe.
4. The complainant continued to dispute the debt that the agency was trying to collect. In 2012, the complainant commenced legal action against the agency in Canada, alleging that the agency had violated several provisions of the complainant's province's consumer protection legislation.
5. In the interim, the complainant had made a formal access request to the agency under PIPEDA on September 18, 2013, for access to his personal information. The agency responded promptly, but informed the complainant that its participation in the process was voluntary and that the complainant needed a court order to compel the agency to produce the personal information requested. The complainant protested to the agency, but to no avail.
6. Consequently, the complainant filed the current complaint against the agency with our Office, which we accepted on February 25, 2014. In his complaint, the complainant alleged that the agency failed to comply with his access request, leading him to be unfairly prejudiced in the court proceedings since he could not prove his assertions. In the complainant's view, this alleged failure of the agency to comply, and the complainant's belief that he did not obtain complete access to all documents under the court's discovery process, negatively impacted the damages he was awarded from his court proceedings.
7. In its representations to our Office, the agency confirmed that it had not responded to the complainant's access request of September 2013. The agency explained that since the complainant's court action had already commenced by then, the agency believed that access to the complainant's documents under PIPEDA would be provided to him by way of the court's discovery process.
8. Once our Office became involved in the matter, and we explained to the agency its obligations under PIPEDA to provide individual access (even when there is a concurrent legal proceeding), the agency provided the complainant with access to his personal information (in the form of copies of specific documents).
9. Our Office has articulated these access obligations in our guidance document PIPEDA and Your Practice: A Privacy Handbook for Lawyers, from which an excerpt is provided below:

   Notwithstanding that a litigation proceeding may be underway, all organizations must respond to access requests in accordance with PIPEDA. Access may be legitimately refused under PIPEDA on grounds that the information is subject to solicitor-client privilege (which includes both legal advice and litigation privilege), or generated in the course of a formal dispute resolution process. However, access may not be refused merely because there are parallel litigation proceedings underway that may involve some of the same information. An individual's right of access is a fundamental right, untempered by that individual's motive for seeking access.…^{Footnote 1} [Emphasis added]

10. Nonetheless, the complainant remained unsatisfied with the documents he received from the agency, believing that missing from them was correspondence between the agency and two large credit reporting agencies.
11. The agency maintained to our Office that such correspondence does not exist. It explained that as a member of the credit reporting agencies, the agency conducts its transactions solely online (i.e., by logging in and viewing the information), leaving no "paper trail". The agency confirmed that there were no forms, emails or letters between itself and the credit reporting agencies, and that, therefore, the agency had provided the complainant with all his personal information that it held.
12. Our Office acknowledged that online, electronic access is the typical means for clients of credit reporting agencies in Canada to conduct their transactions with such agencies. We further acknowledged that in straightforward cases of debt collection, communication between the agencies and the client is often minimal.
13. Later during our investigation, the complainant made a further claim ? that he had not provided his consent for the agency to exchange (i.e., collect and/or disclose) his personal information with any third party (e.g., with credit reporting agencies), nor had he ever provided such consent to the original creditor (i.e., the bank in Europe).

Application

14. In making our determinations, we applied Principle 4.9 of Schedule 1 and paragraph 7(3)(b) of Part 1 of PIPEDA.
15. Principle 4.9 states that, upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
16. Paragraph 7(3)(b) stipulates that for the purpose of clause 4.3 of Schedule 1, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is for the purpose of collecting a debt owed by the individual to the organization.

Findings

17. There is no dispute that the complainant had filed an access request under PIPEDA in September 2012 and that the agency did not provide him with the access as requested.
18. Our investigation established that the agency did not provide any access whatsoever until our Office intervened. Concerning the agency's explanation that it was already involved in court proceedings with the complainant, our Office has already made clear our position on that point (see paragraph 9 above).
19. The agency's succinct response to the complainant in September 2012, that he would require a court order to compel access, is in essence an unlawful denial of his right to access, and is unsupported by any valid access exemptions contained in PIPEDA.
20. For these reasons, Principle 4.9 was not initially upheld.
21. The agency eventually provided the complainant with access to his personal information, as a result of our Office's investigation and intervention. Although the complainant remained adamant that the access was incomplete, our Office's probing into the matter did not reveal that any more of the complainant's personal information was being withheld. We thus consider the complainant's access request to be fulfilled.
22. Therefore, the agency ultimately met its obligations under Principle 4.9.

Conclusion

23. Accordingly, we conclude that the matter is well-founded and resolved.

Other

24. The complainant further alleged that the agency had collected and disclosed his information without his consent when it exchanged information with a third party (e.g., credit reporting agencies). The complainant's allegation also relates to the bank in Europe disclosing his information to a third party debt collector.
25. With regard to consent, while Principle 4.3 of PIPEDA stipulates that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, it also includes a proviso for debt collections: Paragraph 7(3)(b) states specifically that an organization may disclose personal information without the knowledge or consent of the individual if the disclosure is for the purpose of collecting a debt owed by the individual to the organization. This allows a creditor, or their agent(s), certain latitude within the requirements of PIPEDA.
26. The agency, acting as an agent of the creditor (i.e., the bank in Europe), would thus have obtained under paragraph 7(3)(b) the complainant's personal information from the creditor without the complainant's consent. Any exchange of information with a credit reporting agency required to recover the debt would have occurred equally without the complainant's consent, under the same proviso.
27. In addition, we note that the complainant's province's personal information protection legislation provides that an organization may collect personal information about an individual without consent if the information is necessary to facilitate the collection of a debt.

Footnotes