Credit reporting agency takes remedial action after failing to maintain accurate records

PIPEDA Case Summary #2016-010

July 7, 2016

---

Complaint

An individual received his credit file from a credit reporting agency in response to his access to personal information request. The file contained his credit report, which showed two credit inquiries that he did not recognize as his own.

He noted as well that his credit report contained the notation that an “AUTOMATIC COMBINE” of accounts had occurred. As such, his credit file was now being compiled from information reported under three other names, all of which were similar to his own name.

Outcome

The complainant brought the apparent inconsistencies to the agency’s attention, which realized that his credit file and that of another individual had been manually combined (“the combined file”). According to the agency, this occurred after a review of the two files revealed many similarities between them, including similar names and addresses.

Consequently, the agency decided that the two credit inquiries not recognized by the complainant did not belong in his file. The credit reporting agency rectified the situation by separating the previously combined files and adding a note to not combine them in the future.

Use and Disclosure

The complainant then sought more information about how the error occurred. He believed that, when his file was combined with the other, the agency had improperly disclosed his personal information to respond to the two credit inquiries that were not his. For its part, the agency denied this allegation, pointing out that those two inquiries had been made and responded to before the files were ever combined. In responding to the two inquiries at the time, the agency had correctly used and disclosed only the other individual’s personal information to the inquiring organizations, and not the complainant’s personal information.

Moreover, the agency confirmed to our Office that during the time when the files were combined, it did not respond to any credit inquiries on behalf of the other individual, nor did they request a copy of their credit file during that period.

Based on the evidence, our Office was satisfied with the agency’s explanation and determined that there was no use or disclosure of the complainant’s personal information without his consent. Accordingly, the issue of use and disclosure without consent was not well-founded.

Accuracy

However, our Office found that the agency’s handling of the accuracy of the complainant’s personal information did not measure up to requirements pursuant to PIPEDA.

In general, when two separate credit files are combined, the accuracy of the personal information of each individual attached to the files is compromised. In this case, two of the complainant’s own creditors inquired into—and received information from—the combined file; information about another individual was thus attributed to the complainant on those two occasions. This is contrary to Principles 4.6 and 4.6.3.

However, the agency advised our Office that after the two files were separated, and in keeping with Principle 4.9.5, the complainant’s two creditors were subsequently notified of corrections made to the complainant’s credit report.

Because the credit reporting agency corrected its error and committed to enhancing employee training to prevent a recurrence of the event that precipitated this complaint, our Office found that the accuracy issue of this complaint was well-founded and resolved.