Property management company agrees to scrap "bad tenant list"

PIPEDA Report of Findings #2016-002

February 19, 2016

---

The complainant alleged that a property management company was improperly collecting, using and disclosing tenants' personal information by maintaining a "bad tenant" list for a landlord association. The complainant stated that her application for rental accommodation was rejected by a property management company because her name appeared on this list.

The management company confirmed that it held the list on behalf of a landlord association, explaining that landlords added the names of "bad tenants" to the list, along with the reasons they qualified for inclusion. The association used the list to share information about applicants for rental accommodation.

The complainant said she had never consented to her personal information being collected for this purpose. She also stated she was not allowed to see the information or discover which landlord had added her name.

The property management company noted a clause in its rental application, authorizing "the Landlord… to obtain such credit reports or other information as may be deemed necessary in connection with this Application To Rent or for any other direct business requirement." The company said its own clients therefore consented to their information being used in conjunction with the list. The company said it assumed tenants of other landlords in the association had obtained similar consent.

Principles 4.2, 4.3 and 4.3.2 of the Act deal with matters of consent — for consent to be meaningful, individuals must be provided with a reasonably understandable explanation of why their personal information is being collected, and how it is going to be used. We could not see how consent "to obtain such credit reports or other information as may be deemed necessary" would lead individuals to understand they were consenting to their personal information being collected, used and disclosed for the purposes of a "bad tenant" list.

Principles 4.6, 4.6.1 and 4.10 of the Act discuss the need for organizations to take reasonable steps to ensure the accuracy of the personal information they hold — so decisions about individuals are not based on incorrect information — and that individuals should be able to access their information in order to challenge any inaccuracies. This complainant stated that she was not given an opportunity to view or challenge the accuracy of the information included about her.

Subsection 5(3) of the Act says an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. The "bad tenant" list included information about individuals' past paying habits. By giving members of the landlord association access to this type of information, we found the property management company was acting as a credit reporting agency. Credit reporting agencies must have a licence from the province in which they operate. In these circumstances, it was our view that the purpose for which it was collecting, using or disclosing tenants' personal information was not appropriate under subsection 5(3).

The property management company disagreed with our finding that it was acting as a credit reporting agency. Nonetheless, it implemented our recommendation to destroy the bad tenant list and stop collecting information for such a list. As well, members of the landlord association no longer share personal information about prospective tenants without explicit consent.

We concluded that the matter was well-founded and resolved.

---

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (“PIPEDA” or the “Act”)

Summary of Investigation

Complainant

1. The complainant is a single parent who has a child with disabilities. She was attempting to find a new rental accommodation that was fully accessible to her child.
2. When she applied for housing through a property management company, she was informed that she was on a "bad tenant" list due to her owing for damages and having skipped payments. She was told by the property management company that her inclusion on the list was one of the reasons it was denying her housing services.
3. The complainant subsequently learned that the Respondent maintained that "bad tenant" list. Although the Respondent advised the complainant that her name could be removed if she provided a reference from her current landlord, the complainant chose not to do so.
4. The complainant then filed the current complaint against the Respondent with our Office, which we accepted in late February, 2014.

Respondent's position

(a) Purpose of the "bad tenant" list

5. In its representations to our Office, the Respondent confirmed that it maintains a "bad tenant" list of over 2,000 names. According to the Respondent, a tenant could be added to the list if the tenant either has defaulted in rent payments or has not paid for damage to property.
6. The Respondent stated that it does not collect any information directly from tenants, but from members of a landlord association who can access and share the contributed information with each other. Although the members comprising the landlord association do not pay a fee to access the information on the "bad tenant" list, they must pay a membership fee to join the landlord association.
7. The personal information on the "bad tenant" list that the Respondent maintains consists of the following: (i) the tenant's name; (ii) the alleged incident for which the individual's name was added to the list; and (iii) the rental accommodation where the alleged incident occurred. With respect to the complainant, the list included her name and the notation "skipped/damages". There was no indication as to where the alleged incident occurred.
8. The Respondent emphasized that other types of personal information, such as current address, telephone number, social insurance number, credit card number or date of birth are not included in the "bad tenant" list.
9. The Respondent claimed that the information on the "bad tenant" list is used to help landlords "avoid credit default" by potential renters and to determine "valid renters" and that it was not used for other purposes, such as collection of outstanding debts.
10. The Respondent also stated that it considers the list of names of the "bad tenants" to be the information of the landlords. According to the Respondent, the landlords can request the removal of tenants' names from the list when the tenants have rectified the reason for which they were placed on the list.

(b) Knowledge and consent

11. In the Respondent view, its own tenant rental agreement contains a clause which it believes permits the collection of its tenants' information for the purposes of inclusion on a "bad tenant" list. That clause is as follows:

    I/we do hereby authorize the Landlord or their Agent to obtain such credit reports or other information as may be deemed necessary in connection with this Application To Rent or for any other direct business requirement:

12. With respect to the other association members, the Respondent advised our Office that it assumes that tenants have authorized their landlords to share tenant information with the Respondent. However, the Respondent does not have access to any of the rental agreements in the possession of any of the five landlord members that comprise the landlord association.
13. Further, the Respondent confirmed that there is no written agreement between the Respondent and the association members regarding the collection, use and disclosure of the personal information that is contained on the "bad tenant" list.
14. After subsequent discussions with our Office, the Respondent advised that it was prepared to purge the current list, except for those tenants who have publicly available judgments against them concerning their eviction. The Respondent also advised that it would be prepared to ensure that the landlord members are using rental agreements with updated consent clauses.
15. In December, 2015, we sent to the Respondent our preliminary report of investigation in which we advised the Respondent of our Office's recommendations and asked for a response within 30 days.

Application

16. In making our determinations, we applied Principles 4.2, 4.3, 4.3.2, 4.6, 4.6.1 and 4.10 of Schedule 1 of the Act, as well as subsection 5(3) of Part 1 of the Act.
17. Principle 4.2 states that the purposes for which information is collected shall be identified by the organization at or before the time the information is collected.
18. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
19. Principle 4.3.2 requires knowledge and consent. Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.
20. Principle 4.6 states that personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
21. Principle 4.6.1 states in part that personal information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.
22. Principle 4.10 states that an individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.
23. Subsection 5(3) specifies that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances.

Findings

24. Our preliminary analysis first looked at whether a reasonable person would consider the purpose for the collection, use or disclosure of personal information in connection with the "bad tenant" list as being appropriate in the circumstances, pursuant to subsection 5(3).
25. Our Office recognizes that landlords may take appropriate steps to protect their property and evaluate the suitability of prospective tenants. In our view, the collection, use and disclosure of personal information by a landlord for the express purpose of verifying a prospective tenant's ability to pay rent on time or to determine suitability in the context of a rental application process may be appropriate in certain circumstances.
26. For example, it may be appropriate for landlords to undertake credit checks or reference checks to evaluate a prospective tenant's credit worthiness or rental history. These are practices that have been employed historically within the industry, and of which tenants are commonly aware and are often included in the terms of tenant applications.
27. Landlords can conduct limited credit or reference checks with the consent of the prospective tenant for these purposes, or can interview prospective tenants and evaluate their responses. A credit check can flag missteps in the tenant's credit history, which may include missed or late payments, judgments, bankruptcy or past due rent. This information can be helpful in evaluating a tenant as to how they have been able to manage their financial responsibilities and can also reveal facts about the applicant that may have been omitted from the rental agreement, such as previous addresses.
28. In determining whether the Respondent's collection, use or disclosure of personal information in connection with the "bad tenant" list is appropriate in the circumstances, we first assessed whether the Respondent was subject to provincial credit reporting legislation.
29. The applicable provincial credit reporting legislation defines "credit information" as including a consumer's paying habits and outstanding debts. This legislation also provides that no one may act as a credit reporting agency without a license.
30. After a careful analysis of the above noted provisions, it was our conclusion that the Respondent's "bad tenant" list included what would be considered "credit information" and "personal information" under the province's credit reporting legislation and that the Respondent's disclosure of that information to landlords would therefore require the Respondent to be licensed as a credit reporting agency under that Act.
31. Although the provincial credit reporting legislation permits the use of credit report information for the purpose of entering into, or renewal of, a tenancy agreement; it also places limits on the type of information that can be reported and mandates that credit reporting agencies must reasonably ensure the information they report on is accurate and fair and that they have obtained the consent of, or provided notice to, individuals when using their information.
32. Absent any evidence that the Respondent is operating as a licensed credit reporting agency in the province and given that the Respondent appears to be in contravention of the provincial credit reporting legislation, we are of the preliminary view that the Respondent's purposes for collecting, using or disclosing tenants' personal information in the circumstances (i.e., to create a "bad tenant" list) are not objectively appropriate under subsection 5(3).

Knowledge and consent

33. We also considered whether the Respondent has ensured the knowledge and consent of the individuals on the "bad tenant" list in order to collect, use or disclose their personal information, or whether an applicable exception to this obligation under the Act applies.
34. In this respect, we were of the preliminary view that the personal information of individuals appearing on the "bad tenant" list is being collected, used or disclosed without their knowledge and consent.
35. We noted that the Respondent was not directly collecting the personal information from those individuals appearing on the "bad tenant" list. Rather, it was the members of the landlord association who were collecting the personal information from tenants and subsequently disclosing it to the Respondent to populate the list.
36. Our investigation revealed that the Respondent's own standard tenant application form and rental agreement form did not explain in a reasonably understandable manner, as required by Principle 4.2, that applicants' personal information could be collected, used or disclosed for the purposes of inclusion on a "bad tenant" list. With regard to the other association members, the Respondent was not aware, and did not provide, any evidence as to whether the member landlords were: (i) explaining in their respective tenant application forms or rental agreements that a prospective tenant's personal information could be used or disclosed for purposes of inclusion on the Respondent "bad tenant" list, or (ii) obtaining meaningful consent for such a use or disclosure.
37. Based on the evidence before us at the time, we were of the preliminary view that individuals appearing on the "bad tenant" list had not provided their meaningful consent for the collection, use or disclosure of their personal information with respect to inclusion on the "bad tenant" list, as required by Principles 4.3 and 4.3.2.
38. In our view, in order for the Respondent to rely on any valid consent that may have been obtained by any third-party landlord for tenants' inclusion on the "bad tenant" list, the Respondent would have to: (i) establish contractual terms stipulating that the members of the landlord association must obtain appropriate consent from tenants; and (ii) establish a method by which to obtain proof that the tenants affected have in fact consented.

Personal information accuracy and challenging compliance

39. The evidence before our Office in this case also demonstrated that the Respondent was not assessing the accuracy or credibility of any of the personal information it regularly collected on the "bad tenant" list — personal information that the Respondent then disclosed to other landlords and which may form the basis for decisions that could inflict damage on the affected individuals' rental prospects, reputations, lives and those of their dependent family members.
40. There appears to be no way for tenants or applicants to find out if any information about them was contained on the "bad tenant" list. For example, even a misspelling of someone's name (or in cases of individuals with similar names) could result in confusion, i.e., an individual being wrongfully associated with a past incident with a landlord, and consequently being unfairly treated and prejudiced by the prospective landlords who used the "bad tenant" list. In this instance, the complainant cannot recall incurring the debt associated to her name nor was she provided information as to which landlord had included her on the "bad tenant" list. Therefore, there was no way for her to challenge the information.
41. It was unclear to our Office how individuals could ensure the accuracy of their personal information on the "bad tenant" list and, if necessary, challenge the Respondent compliance with respect to maintaining the accuracy, completeness and in the information being up-to-date.
42. In our letter and preliminary report of investigation dated December 22, 2015, we recommended that the Respondent do the following:
    1. Cease the collection, use and disclosure of tenants' personal information for its "bad tenant" list, or any such compilation of the personal information of tenants; and
    2. Destroy the current "bad tenant" list.
43. The Respondent responded in a letter dated January 6, 2016, and advised that it disputed our finding that it was acting as a credit reporting agency and that the information it collected for the purposes of the list was objectively inappropriate.
44. Nonetheless the Respondent confirmed to our Office that:
    1. It has destroyed the "bad tenant" list;
    2. It no longer collects any personal information relating to a "bad tenant" list; and
    3. The list had not been used by the Respondent or any member associations since July 2014 and that no landlords have shared any personal information with other landlords since that date.

Conclusion

45. Accordingly, we conclude that the matter is well-founded and resolved.