Drug activity history in property reports deemed not publicly available

PIPEDA Case Summary #2017-001

August 28, 2017

---

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”)

Complaint

1. The complainant alleged that the respondent collected, used and disclosed personal information relating to the homes of certain individuals without adequate consent from those individuals. More precisely, the complainant alleged that the respondent collected, used and disclosed the following information in its property history reports: (i) sales history; (ii) drug activity [i.e. police activity involving marijuana grow operations (“MGOs”) or methamphetamine labs (“meth labs”)]; and (iii) insurance claims.

Summary of Investigation

2. The respondent, an Ontario-based corporation which operates online, engages in the sale of property history reports (the “reports”) about residential properties across Canada.
3. The respondent markets its reports to: (i) home buyers and sellers; (ii) real estate agents; and (iii) home inspectors. The respondent submitted that it offered two principal types of reports: (i) Essential; and (ii) Comprehensive. The information in the reports varied depending on the report type and the province. For greater certainty:
1. all reports contained drug activity information;
2. only reports for properties in Ontario contained sales historyinformation; and
3. only Comprehensive reports contained insurance claims information.
4. For greater clarity, the respondent’s reports contained additional information (e.g. built date; municipal building permit information). That additional information is outside of the scope of the current complaint.

Collection of information

5. The respondent indicated that its reports include all available information about the property. It further asserted that since such information was restricted to that about the property, it did not include any identifiable personal information. Therefore, the respondent did not limit the information it provided in the report to that associated with the property during the current home owner’s tenure.

Sales history

6. Sales history information comprised the last three registered sales prices and dates for the subject property. The respondent stated that it obtained this information from a third party, which it specified to our Office.
7. The respondent submitted that, in its view, such information was publicly available.

Drug activity

8. Drug activity information comprised of the date of any police activity in respect of an MGO or meth lab at the subject address, as well as the quantity of substance seized by police.
9. The respondent stated that it obtains such information from publicly available sources and through access to information requests to various police services and municipalities.
10. For example, the respondent provided a copy of a response, from an Ontario police service, to an access to information request wherein it was seeking information on MGOs for a specific period.
11. The respondent also provided links to websites for numerous police services that publish this information.

Insurance claims information

12. According to the respondent’s initial submissions to our Office, insurance claims information comprises the date, dollar value and classification of insurance claims in respect of the following types of events or damage: (i) flood; (ii) sewer back-up; (iii) water; (iv) fire; (v) smoke; (vi) wind/hail; (vii) earthquake; (viii) glass breakage; and (ix) building collapse.
13. The respondent indicated that it obtains insurance claims information from a third party in the insurance industry (the “insurance information provider”).^{Footnote 1}

Purposes for which the information is used and disclosed

14. The respondent submitted that it collects, uses and discloses the information outlined above for the purpose of producing and selling its property history reports. Further, it asked our Office to consider that its “service aims to protect home buyers, sellers and industry professionals alike with their legal disclosure and due diligence requirements.”
15. The respondent likened its business model to the provision of vehicle history reports, stating that those reports offer similar data points to provide a detailed history and are widely utilized and accepted to protect consumers.

Consent

16. The respondent stated that it only obtains consent from current owners for the purpose of obtaining insurance claims details from its insurance information provider. While its consent form relied on the “buyer” or their agent to confirm that they had obtained consent from the current owner of the property in question, the respondent indicated that it did not verify that such consent was actually provided by the owners.
17. The respondent clarified, however, that as it did not consider claims information to be personal information, it was not intending to obtain consent, under PIPEDA, for the collection, use and disclosure of such information for inclusion in its reports.

Identifying owners and occupants

18. Through our own research, we confirmed that the identity of current and past owners of properties can be obtained from provincial land registry systems across Canada (e.g. via an Ontario Land Registry Office).
19. Also through our own research, we confirmed that the identity of current and past occupants of properties may be obtained online from websites that contain databases of address information. Further, the identity of current and past occupants in certain municipalities may also be available from assessment rolls (e.g. where the residential tenant is a supporter of a school board).

Application

20. In making our determination, we applied subsection 2(1) and paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of Part 1, and Principles 4.3 and 4.3.2. of Schedule 1 of the Act, as well as section 1 of the Regulations Specifying Publicly Available Information (the “Regulations”).
21. Subsection 2(1) of the Act stipulates that personal information is information about an identifiable individual.
22. Paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) state that, for the purpose of Principle 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect, use or disclose personal information without the knowledge or consent of the individual only if the collection, use or disclosure is of information that is publicly available and specified by the Regulations.
23. Principle 4.3 stipulates that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Principle 4.3.2 further provides that organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.
24. Section 1 of the Regulations specifies, in part, information and classes of information for the purposes of paragraphs 7(1)(d), (2)(c.1) and (3)(h.1) of the Act. These classes of information can be summarized as personal information that appears in a:
    1. telephone directory that is available to the public;
    2. professional or business directory, listing or notice that is to the public;
    3. registry collected under a statutory authority and to which a right of public access is authorized by law;
    4. record or document of a judicial or quasi-judicial body that is available to the public; and
    5. publication, including a magazine, book or newspaper, where individual has provided the information.

The Regulations further require that the collection, use and disclosure of the personal information in respect of subparagraphs (b), (c) and (d) in the aforementioned list relate directly to the purpose for which the information appears therein.

Analysis

25. Our office issued a preliminary report indicating that the respondent failed to obtain adequate consent for the collection, use and disclosure of personal information in its property history reports. Our Office therefore made certain recommendations to the respondent, as set out in paragraphs 40 and 41 below, in order to ensure the organization is acting in compliance with the Act. In response to the preliminary report, the respondent clarified certain points, which are included in the analysis below.

Sales History

26. During the course of our investigation, the respondent confirmed that it had ceased including sales history information in its reports. Accordingly, we will not consider the collection, use and disclosure of that information in our analysis and findings.

Personal information

Insurance Claims

27. In our preliminary report, based on our understanding of the facts at the time, we expressed the preliminary view that insurance claims information was personal information, on the basis that it could reveal that a claimant had received a sum of money.
28. the respondent’s response to our preliminary report, it clarified that claim details were only included in relation to claims for damage to the structure or building (i.e., not in relation to theft, contents or third-party liability) where a payment was made directly to the third-party organization completing the repairs (e.g., the contractor or builder), not to the claimant.
29. Based on this clarification, we accept the respondent’s assertion that, in this particular case, such information is not personal information, in that it is about damage to the structure or building (e.g., due to flood, fire, earthquake), and not about the individual.

Drug Activity

30. Our view remains that drug activity information is personal information under the Act, in that it is about an identifiable individual.
31. Jurisprudence has interpreted when information will be considered “about’” an identifiable individual. ‘About’ means that the information is not just the subject of something, but also relates to or concerns the subject ( Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board) , 2006 FCA 157). Information will be about an ‘identifiable individual’ where there is a serious possibility that an individual could be identified through the use of that information, alone or in combination with other information ( Gordon v. Canada (Health), 2008 FC 258 (CanLII)). ^{Footnote 2}
32. The respondent claimed that the information in its reports is restricted to that about the property and does not include any identifiable personal information. The respondent’s terms of service provided, however, that “information about the Property […] might constitute and/or include ‘personal information’ as defined in applicable law in which the Property is located.”
33. In our view, there is a significant probability that the drug activity information in question could be linked to “identifiable individuals” either alone or in combination with other information. This information could be linked to the individual(s) who owned or occupied the property at the time to which the specific information relates, at least where the owner or occupant is an individual (i.e. not a business). In coming to this determination, we considered that the user requesting the respondent’s product could: (i) know the owner/occupant name(s); (ii) discover the identity of current and previous owners via a provincial land registry system (e.g. the Ontario Land Registry Office); or (iii) discover the identity of current and previous occupants, for example using online resources.
34. Furthermore, in the circumstances, our Office is of the view that the drug activity information included in the respondent’s reports is also “about” the individuals who owned or occupied the property at the time the event occurred, in that it raises a significant possibility and/or perception that the individual: (i) was personally involved in drug activity; and/or (ii) was associated with third parties involved in such activity.

Publicly available information

35. In our view, the sources used by the respondent to obtain drug activity information cannot be associated with any of the specified types of “publicly available information” as set out in the Regulations.
36. For example, an access to information request is not a source of information, but rather a means by which the respondent accessed a source of that information. In the access to information response from a police service that the respondent provided to us, the source of the information was the records of the police service.
37. As a further example, even if the information on a police service website is readily available to the public, these webpages do not constitute: (i) a registry of information collected under a statutory authority, in accordance with paragraph 1(c); (ii) a record or document of a judicial or quasi‑judicial body, within the meaning of paragraph 1(d); or (iii) information in a publication where the information was provided by the individual as required by paragraph 1(e).

Consent

38. Consequently, the respondent is not exempt from the requirement to obtain consent from the individuals concerned. The respondent must therefore ensure adequate consent for the collection, use and disclosure of such information in its reports.
39. The respondent acknowledged that it was not obtaining consent for the use of drug activity information.

Preliminary Report of Investigation

40. In our preliminary report, we recommended that the respondent revise its privacy practices to ensure that it obtains adequate consent for the collection, use and disclosure of personal information in respect of all of its property history reports (i.e. Essential and Comprehensive reports). More specifically, we recommended that the respondent:
    1. obtain such consent directly from the current and previous owner(s) and occupant(s) whose personal information is collected, used or disclosed (and not rely on representations from the buyer that such consent has been granted);
    2. ensure that consent is meaningful, by supporting it with a clear and comprehensive explanation of what personal information will be collected, and with whom it will be shared via the reports; and
    3. retain proof that consent has been obtained.
41. We further recommended that if the respondent is unable to obtain consent as indicated, it should cease the collection, use and disclosure of such personal information for the purpose of issuing property reports.
42. The preliminary report was provided to both parties, which were given the opportunity to respond.

The respondent’s response to the Preliminary Report of Investigation

43. The respondent responded to our preliminary report in writing. We also met with the company to better understand its practices.
44. The respondent confirmed that it had ceased distribution of its reports until such time as it could agree with our Office on changes to its practices that would bring it into compliance with the Act.
45. The respondent asserted, and we accepted, as outlined in paragraphs 28 and 29 above, that, in this particular case, insurance claims information does not represent personal information, and that the respondent is not required to obtain consent for the collection, use and disclosure of such information under the Act.
46. Finally, the respondent committed to our Office that, when it recommences the issuance of its reports, it would no longer include drug activity information therein.

Conclusion

47. Given the respondent’s commitments as outlined above, our Office considers this matter well-founded and resolved.