Consent Unnecessary to Disclose Credit File to Statistics Canada

Consent Unnecessary to Disclose Credit File to Statistics Canada

Despite the complaint ultimately being deemed unfounded, a recent investigation by the Office of the Privacy Commissioner (the “OPC”) highlights the need to proceed with caution when asked to disclose personal information to a government institution.[1]

The Complaint

The complainant was a consumer whose personal information (including credit history) was in the possession of Trans Union of Canada, Inc. (“TransUnion”).

After requesting his credit information from TransUnion, the complainant discovered that Statistics Canada had made two inquiries to TransUnion about his file.

Shortly after Statistics Canada’s first inquiry, the complainant received debt collection phone calls regarding unpaid student loans.  The complainant also alleged that his parents received phone calls from the government about his student debt, and that his parents’ phone numbers were included in TransUnion’s file.

The complainant alleged that TransUnion disclosed his personal information to Statistics Canada without his consent and that his personal information was then shared by Statistics Canada with other government institutions to facilitate debt collection.

TransUnion’s Position

TransUnion admitted to providing Statistics Canada with “administrative consumer data” as part of Statistics Canada’s Credit Information Project about household debt. Accordingly, TransUnion took the position that it was authorized to disclose the complainant’s personal information without his consent because the disclosure was required by law.

TransUnion advised the OPC that it had entered into a strict confidentiality agreement with Statistics Canada in connection with the disclosure of the personal information, including a clause prohibiting the use of the personal information for any purpose other than limited statistical purposes.

Finally, TransUnion submitted (and Statistics Canada confirmed) that it had no evidence of Statistics Canada violating the terms of the confidentiality agreement, including by disclosing the complainant’s credit file to other government institutions or for the purpose of collecting on student loans.

The OPC’s Findings

1. Lawful Access by Statistics Canada

In addition to this complaint against TransUnion, the OPC also received several related complaints against Statistics Canada itself under the Privacy Act.  The OPC’s investigation into these complaints concluded that Statistics Canada had lawfully accessed documents or records maintained by TransUnion in accordance with the Statistics Act.

However, the OPC expressed “significant concern” about whether Statistics Canada had taken adequate steps to respect the principles of necessity and proportionality and to ensure that individuals were notified prior to the collection of their personal information from TransUnion.  Statistics Canada subsequently agreed to implement the OPC’s recommendations in this respect, including redesigning the Credit Information Project before collecting further personal information from TransUnion.

2. No Consent Was Needed

The Personal Information Protection and Electronic Documents Act (“PIPEDA”) allows an organization to disclose personal information without the knowledge or consent of an individual where the disclosure is to a requesting government institution that has identified a lawful authority to obtain the information and has indicated that the disclosure is requested to administer a Canadian law.

The OPC ultimately found that TransUnion met all of the requirements under this exception to PIPEDA’s consent requirements.  In particular, Statistics Canada had identified the Statistics Act as its authority for making its request of TransUnion.  Further, the personal information was requested to carry out Statistics Canada’s statutory mandates of collecting, compiling and analyzing statistical information relating to the activities and conditions of Canadians and of promoting and developing integrated social and economic statistics. Accordingly, the complainant’s consent to the disclosure was not required.

3. No Disclosure By Statistics Canada

The OPC also found that there was no evidence to support the complainant’s allegation that his credit file was disclosed to other government institutions to be used for debt collection.

The OPC noted that Statistics Canada used the complainant’s personal information only for statistical purposes and that measures were in place to ensure that the information was anonymized. The fact that debt collection calls began not long after TransUnion’s disclosure of the complainant’s personal information to Statistics Canada was effectively a coincidence and not, in and of itself, sufficient to implicate Statistics Canada or TransUnion in the improper disclosure of personal information.

Takeaways for Your Business

The findings of this investigation are highly fact-specific.  Had Statistics Canada’s request been found to be unsupported by a statutory mandate, or had it in fact passed along the complainant’s personal information to a third party, the outcome would have been significantly different.

To that end, requests from government institutions for the disclosure of personal information should be treated with care.  Not all requests from government institutions will entitle an organization to automatically disclose requested personal information without notifying or obtaining the consent of the affected individual(s). At a minimum, organizations should ensure that the request clearly indicates why the request is being made and under what authority. Furthermore, an organization facing such a request should consider whether entering into a confidentiality or other agreement with the government institution is appropriate in the circumstances.

When faced with a request from a government institution to disclose personal information, organizations should familiarize themselves with the requirements of PIPEDA and are advised to contact a member of McMillan’s Privacy and Data Protection Group prior to making any disclosure.

by Kristen Pennington and Omar Mashnuk, Student-at-Law

[1] “Credit reporting agency is authorized to rely on exemption to consent in disclosing credit information to Statistics Canada”, PIPEDA Findings #2019-007.

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2019