Want to stay current on e–commerce law? Sign up for Email Newsletter.
Federal Privacy Commissioner Finds Collection of Personal Credit Information by Law Firms Violates Privacy Laws
The federal Privacy Commissioner’s office has recently dealt with two complaints concerning the gathering of private information by law firms. In both cases a credit check was performed without the permission of the person whose credit was examined. The firms were not investigating the credit worthiness of one of its clients, but of someone else. In one case, a credit check was performed because the law firm sought information to help it decide whether a counter-claim against someone suing one of their clients was worth pursuing. Both firms took the position that PIPEDA was not relevant to their situations, and therefore the federal Privacy Commissioner had no jurisdiction to investigate.
One law firm argued that the information was collected on the client’s behalf for possible litigation, and therefore did not constitute part of the commercial activity of the firm. The Commissioner, however, took the view that the collection of information did occur in the course of the firm’s commercial activities; as there are no general exclusion for the activities that law firms undertake on their clients’ behalf, the collection of information fell within the jurisdiction of the Commission.
It was also argued that the federal Privacy Commissioner’s Office did not have jurisdiction to investigate because obtaining credit reports is covered by consumer reporting legislation; only the provincial government has jurisdiction to deal with the complaint. The Commissioner’s office noted that under PIPEDA it could exercise discretion not to investigate a complaint if it could be dealt with more appropriately by procedures provided for under the laws of a province. However, in this case a complaint was filed with the appropriate provincial ministry; the ministry looked into it and considered the matter closed. It is under these circumstances that the Commissioner’s office decided that it should investigate.
The firm investigating a counterclaim also argued that one of the exceptions under PIPEDA applies to its facts thus permitting it to seek the information without consent. The exception in question applies when it is reasonable to expect that collection with consent would compromise the availability or accuracy of the information; collections without consent are also reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province. The Commissioner’s office, however, held that this exception did not apply. The firm had not adequately proven that there was a concern over the investigation being thwarted, and in any case investigating whether a counterclaim was worthwhile did not constitute investigating a breach of an agreement or a contravention of a law of Canada or a province.
Both law firms also initially refused to accept the Privacy Commissioner’s findings and recommendations, but ultimately agreed to do so before the matter was taken to Federal Court.
For additional information, please visit the Office of the Privacy Commissioner of Canada: