Credit reporting agency is authorized to rely on exemption to consent in disclosing credit information to Statistics Canada

PIPEDA Findings #2019-007

December 9, 2019

Complaint

1. The complainant alleges that Trans Union of Canada, Inc. (“TransUnion”) disclosed his credit file information to Statistics Canada without having obtained his requisite consent. He further alleges that Statistics Canada subsequently disclosed his credit file information to other government institutions and that the information was used for the purpose of initiating debt collection efforts against him.

Summary of investigation

Background

2. The complainant is a consumer whose personal information and credit history reside with TransUnion, which is a consumer credit reporting agency. The complainant obtained his credit file information from the respondent and discovered that Statistics Canada made inquiries on his file on January 1, 2018 and September 24, 2018.
3. Approximately two months after the first inquiry, the complainant started receiving phone calls from a collection agency for the purpose of recovering a debt for an unpaid student loan that he had obtained through the Government of Canada 24 years before. He alleges that the agency also contacted his parents to put pressure on him to settle the debt. He notes that his parents’ phone number appears on his TransUnion credit file. The complainant believes that Statistics Canada disclosed his credit file information to other government institutions and that the information was subsequently used for the purpose of initiating the debt collection efforts.
4. The complainant contacted the respondent and advised that he was concerned about the disclosure of his personal information to Statistics Canada. He stated that he would file a complaint with our Office. In response, the respondent advised that it had provided Statistics Canada with administrative consumer data, under the authority of the Statistics Act^{Footnote 1}:

   To reduce costs and avoid collecting information that is already available, Statistics Canada is using administrative data to help improve social and economic statistics.

   To this end, TransUnion is providing Statistics Canada with administrative consumer data, under the authority of the Statistics Act. The administrative data obtained from TransUnion will never be used for any other purpose than to produce aggregate statistics. Statistics Canada is not reviewing the credit history of individual Canadians or performing credit checks on individual Canadians. Statistics Canada’s use of TransUnion information will have no impact on any individual’s credit score.

   All information collected, stored or used by Statistics Canada is protected by the confidentiality provisions of the Statistics Act and the Privacy Act.

5. The complainant was not satisfied and filed a complaint with our Office alleging that the respondent disclosed his personal information to Statistics Canada without his requisite consent and that the information was subsequently used for the purpose of collecting a debt from him.

Respondent’s representations to our Office

6. The respondent provided our Office with a letter from Statistics Canada dated March 28, 2017, which requested that the respondent provide Statistics Canada with consumer credit information. The request was made in the context of Statistics Canada’s Credit Information Project, which was aimed at generating statistics relating to household debt levels, among other subjects. In the letter, Statistics Canada stated the following:

   The continued cooperation of our survey respondents and data providers such as your organization enables Statistics Canada to fulfil its mandate to collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and condition of the people. Under the Statistics Act, Statistics Canada is mandated to promote and develop integrated social and economic statistics pertaining to the whole of Canada and to each of the provinces and territories thereof and to coordinate plans for the integration of those statistics…

   Statistics Canada is looking into increasing its use of administrative data in the best interest of Canadians. In that context, I am writing to request access to Consumer Debt Data to be used for statistical purposes only as this particular data source is expected to achieve that goal.

7. In the letter, Statistics Canada stated that its authority for the request came from section 13 of the Statistics Act which authorizes the Chief Statistician or his delegates to obtain any documents or records that are maintained in any department or in any municipal office, corporation, business or organization, from which information is sought in respect of the objects of the Statistics Act.
8. The respondent represented that, with the above request from Statistics Canada, it was authorized under paragraph 7(3)(i) of PIPEDA to disclose the complainant’s personal information without his knowledge or consent since the disclosure was required by law.
9. In order to regulate the disclosure of the information, the respondent and Statistics Canada entered into an agreement on March 28, 2018. The agreement provided for scheduled delivery of certain credit information covering the period from 2002 to December 2017, and the potential for future delivery of information for the calendar years 2018 and 2019. The agreement referred to section 13 of the Statistics Act as the basis for Statistics Canada’s authority to collect the information and warranted that Statistics Canada required the disclosure of the information by the respondent.
10. The agreement also referred to subparagraph 7(3)(c.1)(iii) of PIPEDA as the basis for the respondent’s authority to disclose personal information without knowledge or consent.
11. In relation to the complainant’s allegation with respect to the initiation of debt collection efforts, the respondent represented that it had no evidence that Statistics Canada disclosed his credit file information to other government institutions or that his information was subsequently used for the purpose of collecting his outstanding student loan debt.
12. The respondent contended that section 17 of the Statistics Act imposes strict confidentiality obligations on Statistics Canada. Under subsection 17(1), Statistics Canada is prohibited from releasing any information it collects that could identify any person, business, or organization, unless consent has been given by the affected party or as permitted elsewhere by the Statistics Act.
13. In addition, the respondent indicated that the agreement sets out strict conditions and obligations on Statistics Canada regarding the confidentiality and security of the data including:
    1. A prohibition on Statistics Canada from using data collected from the respondent for any other purpose other than expressly set out in the agreement;
    2. A requirement for Statistics Canada to remove personal identifiers associated with the data collected from the respondent after use for the limited purposes set out in the agreement;
    3. A requirement for Statistics Canada not to release data collected from the respondent in a manner that would directly or indirectly identify any individual; and
    4. Provisions relating to the monitoring and compliance with the foregoing, including a requirement to maintain a record and approve all persons who have been granted access to the data and a requirement for annual audits of the use, disclosure and security of the data.
14. The respondent noted that pursuant to the agreement, Statistics Canada was also required to complete a privacy impact assessment in respect of its intended collection and use of information. Statistics Canada filed a copy of the privacy impact assessment with our Office. It stated that it would use the information for statistical purposes only, in support of its mandate.^{Footnote 2}
15. The respondent further represented that there is no evidence suggesting that Statistics Canada had contravened any provisions under the agreement. Rather, the respondent believed that the complainant mistakenly assumed that Statistics Canada disclosed his credit file information to other government institutions on account of the coincidental timing of calls he received from a debt collection agency, which occurred around the same time period that Statistics Canada first collected the complainant’s personal information.
16. The respondent was able to confirm that a debt collection agency did obtain a copy of the complainant’s credit file on February 7, 2018. The respondent indicated that it is likely that the collection agency would have obtained the telephone numbers listed in the complainant’s credit file and attempted to contact the complainant in March 2018.

Statistics Canada’s representations to our Office

17. Our Office reached out to Statistics Canada and inquired as to whether it had disclosed the complainant’s information obtained from the respondent to any other government institutions or private organizations. By way of letter, Statistics Canada confirmed that it had not.

Our investigation into Statistics Canada under the Privacy Act

18. Our Office received several related complaints, including from the complainant, against Statistics Canada under the Privacy Act, which included allegations of unlawful collection of information from the respondent. We initiated an investigation into those complaints.
19. In the context of that investigation, the respondent provided representations as a third party. Our Office asked the respondent to explain how it provided the requested information to Statistics Canada. The respondent explained that it maintains a system that it uses to reply to requests for information as part of its business operations. It stated that it did not create a technical process to respond to Statistics Canada’s request and used the same system and processes to provide the information requested by Statistics Canada. It maintained that responding to Statistics Canada’s request did not involve the creation of a new document or record.
20. In that investigation, we determined that Statistics Canada had lawfully accessed documents or records maintained by the respondent pursuant to its authority under section 13 of the Statistics Act. We concluded that Statistics Canada had collected personal information that related directly to an authorized program or activity of Statistics Canada in accordance with its obligations under the Privacy Act.
21. Nevertheless, we had very significant concerns that, while Statistics Canada may have had the lawful authority to collect the credit information at issue, it did not respect the principles of necessity and proportionality and therefore did not adequately respect privacy. We also had concerns that Statistics Canada did not take sufficient steps to be transparent and to ensure that affected individuals were notified prior to their personal information being collected. We note in this regard that Statistics Canada has committed to implementing the recommendations we made in the context of that investigation, including re-designing its Credit Information Project before proceeding further with it.

Analysis

Disclosure to Statistics Canada

22. Considering our Office’s findings in the investigation into Statistics Canada under the Privacy Act and the evidence submitted by the respondent, we are of the view that the respondent disclosed the complainant’s personal information in accordance with subparagraph 7(3)(c.1)(iii) of PIPEDA.
23. While the respondent relied on paragraph 7(3)(i) of PIPEDA in its representations, our Office analysed the matter under subparagraph 7(3)(c.1)(iii). This was the provision referenced in the agreement between Statistics Canada and the respondent.
24. Subparagraph 7(3)(c.1)(iii) of PIPEDA authorizes an organization to disclose personal information without the knowledge or consent of an individual to a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that the disclosure is requested to administer a law of Canada.
25. In its letter to the respondent dated March 28, 2017 and in the agreement with the respondent, Statistics Canada indicated that the disclosure of personal information was requested to administer the Statistics Act and fulfil its duties. Statistics Canada also identified its lawful authority for the request as being section 13 of the Statistics Act.
26. As noted above, we determined in the context of our Privacy Act investigation that Statistics Canada acted within its lawful authority under section 13 of the Statistics Act in the circumstances when it accessed the documents or records maintained by the respondent, which included the personal information of the complainant.
27. We are also satisfied that the purpose of the request related to the administration of the Statistics Act. In particular, the purpose of Statistics Canada’s request was to obtain information for its Credit Information Project, which was aimed at generating statistics relating to household debt levels, among other subjects. Under the Statistics Act, Statistics Canada has the duty to “collect, compile, analyse, abstract and publish statistical information relating to the commercial, industrial, financial, social, economic and general activities and conditions of the people.”^{Footnote 3} It also has the duty to “promote and develop integrated social and economic statistics pertaining to the whole of Canada and to each of the provinces thereof and to coordinate plans for the integration of those statistics.”^{Footnote 4} The Credit Information Project therefore fell within Statistics Canada’s mandate.
28. In light of this, our Office determines that the respondent disclosed the complainant’s personal information without his knowledge or consent to Statistics Canada in accordance with subsection 7(3)(c.1)(iii) of PIPEDA.

Initiation of debt collection efforts

29. With respect to the second allegation, our Office found no evidence to support the complainant’s allegation that Statistics Canada disclosed his personal information to other government institutions which subsequently used it for the purpose of collecting a debt he owed for unpaid students loans.
30. We note that this matter relates more directly to the actions of Statistics Canada rather than the actions of the respondent. Nonetheless, both the respondent and Statistics Canada provided representations and information in that regard. We note that there were legal and contractual measures in place that provided for anonymization and limited Statistics Canada’s use and potential disclosure of the information collected from the respondent. Both in the agreement and in the privacy impact assessment that Statistics Canada submitted to our Office, Statistics Canada’s use of the information is limited to statistical purposes only.
31. Ultimately, we acknowledge that the calls received from the debt collection agency occurred after Statistics Canada’s first access to the complainant’s credit file. However, we find that this fact is not, in and of itself, sufficient to indicate that the information Statistics Canada had obtained concerning the complainant was disclosed to a third party. Furthermore, we are satisfied with Statistics Canada’s confirmation that it has not shared the complainant’s information with another government institution or private organization.

Conclusion

32. Accordingly, our office concludes that the complaint is not well-founded.