Cable provider removes personal information posted online of customers with overdue accounts

Incident Summary #10

January 25, 2016

Incident

In early December 2015, our Office was alerted to the existence of a Facebook page for a certain municipality on which a local cable television provider had posted a list of its customers having overdue accounts and the amounts they owed. Due to the sensitivity of the personal information, our Office immediately contacted the cable provider and requested that it remove the posting. The cable provider believed the practice to be permissible, citing as an example municipalities who publish the names of individuals in arrears for their property taxes.

We then shared with the cable provider information from our website about past cases on this same issue. We also sent a guidance document on best privacy practices for businesses and organizations.

Outcome

The cable provider agreed to remove the posting with the customers' personal information from the Facebook page.

Our Office also contacted the Information and Privacy Commissioner for the Northwest Territories (NWT), where the incident occurred, both as a courtesy and to obtain additional information on the practice of publishing the names of individuals in property tax arrears (as this is included in a territorial law and so under her jurisdiction). The NWT Commissioner was aware of the situation and had already contacted the cable provider, advising that it was subject to PIPEDA and asking that the posting be removed.

On the property tax example cited by the cable provider, the NWT Commissioner explained to our Office that publishing the names of people who are in arrears is a requirement of the NWT's Property Assessment and Taxation Act. The NWT Commissioner had however publicly objected to this requirement, calling for the Act to be amended.

Our Office then re-contacted the cable provider, explaining how this legislative framework underpins the publication of the names of people whose municipal property taxes are in arrears. The cable provider then inquired about how paragraph 7(3)(b) of PIPEDA allows for the disclosure of an individual's personal information to collect a debt they owe. Our Office explained that, for example, this exemption to consent under PIPEDA allows for disclosing the debtor's personal information to a third-party debt collector who is acting as the agent of the organization owed.

It does not, however, allow organizations to publicly disseminate information about their debtors without the debtors' knowledge or consent.