[author: Tim Banks]
Last month’s U.S. Federal Trade Commission’s U.S.$800,000 settlement with Spokeo, Inc. concerns an issue that I have posted about before: When is a data broker a consumer or credit reporting agency? As discussed below, the quantum of potential exposure for violating Ontario law relating to consumer reporting may be lower than in the U.S.; however, data brokers should seek legal advice to ensure that they are compliant.
In the recent U.S. case involving Spokeo, Inc., the FTC alleged that the organization was a data broker which collected personal information about consumers from on-line and off-line sources and then created data profiles for consumers to which it sold access. The FTC also alleged that the organization failed to ensure that it was complying with the U.S. Fair Credit Reporting Act (FCRA). In particular, the FTC alleged that the organization did not ensure that (a) the information was used for the limited purposes permitted by the FCRA, (b) the information was accurate, and (c) users of the data understood that the they were required to notify a consumer if the user of the data took an adverse action against the consumer based on the data in the report.
Ontario (and other jurisdictions in Canada) have legislation that is similar to the FCRA. The Consumer Reporting Act (Ontario) prohibits any person from conducting or acting as a consumer reporting agency or as a personal information investigator unless registered with the Ontario Registrar of Consumer Reporting Agencies. The potential monetary liability in Ontario may be smaller than in the U.S., but it remains serious. Violating the Consumer Reporting Act is a provincial offence. Corporations may be subject to fines of up to Cdn. $100,000 and officers and directors of those corporations may be subject to fines of up to Cdn. $25,000 (or in extreme cases, jail terms of up to 1 year or fines and jail terms).
In Ontario, a “consumer reporting agency” is a person or organization who furnishes consumer reports for gain or profit or on a regular co-operative non-profit basis. “Consumer reports” are written, oral or other communication of credit information or personal information which may be used for limited purposes. Those purposes include:
the extension of credit to or the purchase or collection of a debt of the consumer to whom the information pertains;
in connection with the entering into or renewal of a tenancy agreement;
underwriting of insurance involving the consumer; and
a business or credit transaction involving the consumer.
A “personal information investigator” is a person who gathers personal information for consumer reporting agencies.
Consumer reporting agencies are prohibited from providing information from their files unless they have reason to believe it will be used for purposes permitted by the Consumer Reporting Act. The Consumer Reporting Act also prohibits certain types of data from forming part of the consumer report, including among other things:
any credit information based on evidence that is not the best evidence reasonably available;
any unfavourable personal information unless it has made reasonable efforts to corroborate the evidence on which the personal information is based, and the lack of corroboration is noted with and accompanies the information;
information regarding any criminal charges against the consumer where the charges have been dismissed, set aside or withdrawn; and
information as to race, creed, colour, sex, ancestry, ethnic origin, or political affiliation.
Like the FCRA, the Consumer Reporting Act requires disclosure to a consumer if a benefit is denied or a charge to a consumer is increased because of information from a consumer reporting agency. Consumers have the right to obtain access to their consumer reports.
Depending on its target market, a data broker may cross the line into consumer reporting. Organizations that are in the business of providing identity verification or background checking services or who gather data for those purposes should be particularly careful to seek legal advice to determine whether their business model has crossed the line into consumer reporting.