Digital Brain
digital brain
digital brain

Consent Unnecessary to Disclose Credit File to Statistics Canada

December 2019 Privacy Law Bulletin 4 minute read

Despite the complaint ultimately being deemed unfounded, a recent investigation by the Office of the Privacy Commissioner (the “OPC”) highlights the need to proceed with caution when asked to disclose personal information to a government institution.[1]

The Complaint

The complainant was a consumer whose personal information (including credit history) was in the possession of Trans Union of Canada, Inc. (“TransUnion”).

After requesting his credit information from TransUnion, the complainant discovered that Statistics Canada had made two inquiries to TransUnion about his file.

Shortly after Statistics Canada’s first inquiry, the complainant received debt collection phone calls regarding unpaid student loans.  The complainant also alleged that his parents received phone calls from the government about his student debt, and that his parents’ phone numbers were included in TransUnion’s file.

The complainant alleged that TransUnion disclosed his personal information to Statistics Canada without his consent and that his personal information was then shared by Statistics Canada with other government institutions to facilitate debt collection.

TransUnion’s Position

TransUnion admitted to providing Statistics Canada with “administrative consumer data” as part of Statistics Canada’s Credit Information Project about household debt. Accordingly, TransUnion took the position that it was authorized to disclose the complainant’s personal information without his consent because the disclosure was required by law.

TransUnion advised the OPC that it had entered into a strict confidentiality agreement with Statistics Canada in connection with the disclosure of the personal information, including a clause prohibiting the use of the personal information for any purpose other than limited statistical purposes.

Finally, TransUnion submitted (and Statistics Canada confirmed) that it had no evidence of Statistics Canada violating the terms of the confidentiality agreement, including by disclosing the complainant’s credit file to other government institutions or for the purpose of collecting on student loans.

The OPC’s Findings

1. Lawful Access by Statistics Canada

In addition to this complaint against TransUnion, the OPC also received several related complaints against Statistics Canada itself under the Privacy Act.  The OPC’s investigation into these complaints concluded that Statistics Canada had lawfully accessed documents or records maintained by TransUnion in accordance with the Statistics Act.

However, the OPC expressed “significant concern” about whether Statistics Canada had taken adequate steps to respect the principles of necessity and proportionality and to ensure that individuals were notified prior to the collection of their personal information from TransUnion.  Statistics Canada subsequently agreed to implement the OPC’s recommendations in this respect, including redesigning the Credit Information Project before collecting further personal information from TransUnion.

2. No Consent Was Needed

The Personal Information Protection and Electronic Documents Act (“PIPEDA”) allows an organization to disclose personal information without the knowledge or consent of an individual where the disclosure is to a requesting government institution that has identified a lawful authority to obtain the information and has indicated that the disclosure is requested to administer a Canadian law.

The OPC ultimately found that TransUnion met all of the requirements under this exception to PIPEDA’s consent requirements.  In particular, Statistics Canada had identified the Statistics Act as its authority for making its request of TransUnion.  Further, the personal information was requested to carry out Statistics Canada’s statutory mandates of collecting, compiling and analyzing statistical information relating to the activities and conditions of Canadians and of promoting and developing integrated social and economic statistics. Accordingly, the complainant’s consent to the disclosure was not required.

3. No Disclosure By Statistics Canada

The OPC also found that there was no evidence to support the complainant’s allegation that his credit file was disclosed to other government institutions to be used for debt collection.

The OPC noted that Statistics Canada used the complainant’s personal information only for statistical purposes and that measures were in place to ensure that the information was anonymized. The fact that debt collection calls began not long after TransUnion’s disclosure of the complainant’s personal information to Statistics Canada was effectively a coincidence and not, in and of itself, sufficient to implicate Statistics Canada or TransUnion in the improper disclosure of personal information.

Takeaways for Your Business

The findings of this investigation are highly fact-specific.  Had Statistics Canada’s request been found to be unsupported by a statutory mandate, or had it in fact passed along the complainant’s personal information to a third party, the outcome would have been significantly different.

To that end, requests from government institutions for the disclosure of personal information should be treated with care.  Not all requests from government institutions will entitle an organization to automatically disclose requested personal information without notifying or obtaining the consent of the affected individual(s). At a minimum, organizations should ensure that the request clearly indicates why the request is being made and under what authority. Furthermore, an organization facing such a request should consider whether entering into a confidentiality or other agreement with the government institution is appropriate in the circumstances.

When faced with a request from a government institution to disclose personal information, organizations should familiarize themselves with the requirements of PIPEDA and are advised to contact a member of McMillan’s Privacy and Data Protection Group prior to making any disclosure.

by Kristen Pennington and Omar Mashnuk, Student-at-Law

[1] “Credit reporting agency is authorized to rely on exemption to consent in disclosing credit information to Statistics Canada”, PIPEDA Findings #2019-007.

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2019

Insights (5 Posts)

Featured Insight

Corporate Counsel Webinar | Beyond the Basics: Tools and Strategies to Create a More Inclusive Legal Work Environment

Join our guest speaker, Jodie Glean-Mitchell, Executive Director of Equity, Diversity and Inclusion, from the University of Toronto as we invite participants to dive deeper into the intricacies of intersectional identities and experiences with (micro)aggressions and their implications for the legal work environment.

Details
Tuesday, December 13, 2022
Featured Insight

The Exclusion of Intrusion Upon Seclusion: Ontario Court of Appeal definitively determines that “Database Defendants” cannot be held liable for intrusions committed by third-party hackers

The Court of Appeal for Ontario released a trio of decisions that materially impact the viability of class actions following a data breach.

Read More
Dec 1, 2022
Featured Insight

20 More Years of Copyright Protection Starting December 30, 2022

The extension of general copyright protections from 50 years to 70 years after the life of the author shall come into force on December 30, 2022.

Read More
Nov 30, 2022
Featured Insight

Canada Embraces the Indo-Pacific: New Canadian Strategy Expands Opportunities for Two-way Trade and Investment

Canada announces new Indo-Pacific Strategy, applies to join Indo-Pacific Economic Framework, and what it all means for Canadian businesses.

Read More
Nov 30, 2022
Featured Insight

Reporting Issuers Need to be Factual and Balanced, Striving for Accurate and Comprehensive ESG reporting

The CSA cautions issuers against overly promotional "greenwashing" language in continuous disclosure in its biennial report - Staff Notice 51-364.

Read More
Nov 30, 2022