2010 FC 1284, 2010 FC 1284

[2012] 3 F.C.R. 600 T-246-10 2010 FC 1284 Mirza Nammo ( Applicant ) v. TransUnion of Canada Inc. ( Respondent ) Indexed as: Nammo v. TransUnion of Canada Inc. Federal Court, Zinn J.—Calgary, October 19; Ottawa, December 20, 2010. Privacy — Personal Information Protection and Electronic Documents Act — Application pursuant to Personal Information Protection and Electronic Documents Act (PIPEDA), s. 14 alleging that respondent violating

Schedule 1 to PIPEDA, clauses 4.6, 4.6.1, 4.7, 4.7.1, 4.9.5, 4.10.2, 4.10.4 — Bank refusing applicant’s loan application based on negative credit report — Report erroneously containing information relating to someone other than applicant — Respondent amending applicant’s credit file, notifying bank, but failing to explain error — Privacy Commissioner concluding applicant’s complaint resolved — Issues whether PIPEDA breached, whether remedy should be ordered — Respondent breaching

Schedule 1 to PIPEDA, clauses 4.6, 4.6.1 — Respondent’s

interpretation of clauses 4.6, 4.6.1, 4.9.5 untenable — Fact respondent taking steps to correct breach not meaning breach did not occur — Clause 4.9.5 independent requirement — Respondent appropriately correcting information, but notification to bank not transmitting amended information as required under clause 4.9.5 — Applicant entitled to award of damages pursuant to PIPEDA, s. 16 — Reasoning in Vancouver (City) v.

Ward to determine damages applied herein — Unreasonable for respondent to take long delay in correcting error — Exacerbating situation by failing to: accept responsibility, inform bank of correction in unambiguous manner — Application allowed in part. This was an application pursuant to

section 14 of the Personal Information Protection and Electronic Documents Act (PIPEDA) alleging that the respondent violated clauses 4.6, 4.6.1, 4.7, 4.7.1, 4.9.5, 4.10.2, and 4.10.4 of

Schedule 1 to PIPEDA. The Royal Bank of Canada (RBC) refused the applicant’s business loan application based on a negative credit report. The information pertaining to the credit report was supplied to the respondent by a collection agency and related to someone other than the applicant. Following a complaint by the applicant, the respondent investigated and received confirmation from the collection agency that the applicant’s allegations of inaccurate information were justified. The respondent consequently amended the applicant’s credit file to reflect the correct information and notified the RBC of the change.

However, the respondent failed to explain how inaccurate information had been placed in the applicant’s file. The Privacy Commissioner of Canada concluded that, while the respondent failed in its obligations under clauses 4.6, 4.6.1 and 4.9.5 of

Schedule 1 to PIPEDA , the complaint was resolved by the respondent’s action to amend the applicant’s file. The issues were whether the respondent breached PIPEDA and, if so, whether a remedy should be ordered. Held , the application should be allowed in part. The respondent breached PIPEDA by failing to meet its obligations under clauses 4.6 and 4.6.1 to maintain accurate, complete and up-to- date information. It is not tenable to find that a breach of clause 4.6 has not occurred where an organization responds adequately to correct inaccurate information pursuant to clause 4.9.5.

Just because an organization has taken steps to correct a breach does not mean that a breach did not occur. The correct

interpretation of PIPEDA requires that clause 4.9.5 be viewed as an independent requirement, not as an escape hatch to be read into clause 4.6. Clauses 4.6 and 4.6.1 do not provide that the time to assess the accuracy of the information is after one has been informed that it is not accurate, complete or current. The suggestion that a breach may be found only if an organization’s accuracy practices fall below industry standards is also untenable. It was appropriate for the respondent to correct the false credit information.

However, because the respondent did not provide details of the amendment or an updated credit report to the RBC, it cannot be said that the respondent’s notification to the RBC transmitted the amended information as required under clause 4.9.5. The applicant was entitled to an award of damages as a result of the breaches of PIPEDA by the respondent. Damages may be awarded pursuant to

section 16 of PIPEDA even when no financial loss has been proven. The violation of the applicant’s rights under PIPEDA was a serious breach involving financial information of high personal and professional importance. The Supreme Court’s reasoning in Vancouver (City) v. Ward to determine an award of damages also applies to a breach of PIPEDA. It was not reasonable for the respondent to take 20 days to make a phone call to determine that it had placed inaccurate information on the applicant’s file.

The respondent exacerbated the situation by failing to accept responsibility and to unambiguously inform the financial institutions that the information previously sent was wrong. Finally, a procedural review of the respondent’s methods of work was not necessary to determine how the inaccurate information was placed in the applicant’s file. STATUTES AND REGULATIONS CITED Canadian Charter of Rights and Freedoms , being

Part I of the Constitution Act, 1982 ,

Schedule B, Canada Act 1982 , 1982, c. 11 (U.K.) [R.S.C., 1985, Appendix II, No. 44]. Fair Trading Act , R.S.A. 2000, c. F-2, s. 50. Federal Courts Act , R.S.C., 1985, c. F-7, s. 1 (as am. by S.C. 2002, c. 8 , s. 14). Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5, ss. 3, 5 , 8(1) , 14 , 16 , Sch. 1, clauses 4.6, 4.6.1, 4.7,

4.7.1, 4.9, 4.9.4, 4.9.5, 4. 10, 4.10.2, 4.10.4. Privacy Act, R.S.C., 1985, c. P-21. CASES CITED applied: Randall v. Nubodys Fitness Centres, 2010 FC 681, 371 F.T.R. 180; Vancouver (City) v. Ward, 2010 SCC 27, [2010] 2 S.C.R. 28, 321D.L.R. (4th) 1, [2010] 9 W.W.R. 195. considered: Haskett v. Equifax Canada Inc., , 63 O.R. (3d) 577, 224 D.L.R. (4th) 419, 15 C.C.L.T. (3d) 194 (C.A.); Neil v.Equifax Canada Inc., 2006 SKQB 169, 277 Sask. R. 275; Lavigne v. Canada (Office of the Commissioner of Official Languages), 2002SCC 53, [2002] 2 S.C.R. 773, 214 D.L.R. (4th) 1, 289 N.R. 282; Eastmond v.

Canadian Pacific Railway, 2004 FC 852, 16 Admin. L.R.(4th) 275, 33 C.P.R. (4th) 1. AUTHORS CITED Linden, Allen M. and Bruce Feldthusen. Canadian Tort Law, 8th ed. Markham, Ont.: LexisNexis Butterworths, 2006. appLication pursuant to

section 14 of the Personal Information Protection and Electronic Documents Act (PIPEDA) alleging that therespondent violated clauses 4.6, 4.6.1, 4.7, 4.7.1, 4.9.5, 4.10.2, and 4.10.4 of

Schedule I to PIPEDA. Application allowed in part. APPEARANCES Mirza Nammo on his own behalf. Tamara R. Prince for respondent. SOLICITORS OF RECORD Osler, Hoskin & Harcourt LLP for respondent. The following are the reasons for judgment and judgment rendered in English by [1] Zinn J.: This is an application, pursuant to

section 14 of the Personal Information Protection and Electronic Documents Act, S.C.2000, c. 5 (PIPEDA), in respect of a complaint made to the Privacy Commissioner of Canada (PCC) by the applicant on April 8, 2008.He claims that the respondent (TransUnion) “disclosed inaccurate personal information to a bank in connection with a loan applicationthat resulted in the credit history of another individual being attributed to Mr. Nammo.” [2] On January 22, 2010, the PCC issued her report, concluding “that the matter is well-founded and resolved”. Mr. Nammo in hisapplication to this Court alleges that the respondent violated clauses 4.6, 4.6.1, 4.7, 4.7.1, 4.9.5, 4.10.2, and 4.10.4 of

Schedule 1 toPIPEDA.[1] He further alleges that the acts of the respondent violated Alberta’s Fair Trading Act, R.S.A. 2000, c. F-2. [3] Mr. Nammo asks the Court: (

i) to order a “procedural review” of the respondent’s methods of work to determine how incorrect financial data was placed on his creditfile; (ii) to award him damages of $250 000 for losses caused as a result of the respondent supplying false information to a bank, negativelyaffecting his business loan application; and (iii) to award him damages in a “reasonable sum” for the stress, mental anguish and embarrassment caused by the respondent. [4] For the reasons that follow, this application is allowed, in part. Background [5] Mr.

Nammo says that he was offered a business opportunity by someone who wished to start a trucking business but who did nothave the financial wherewithal to secure a business loan. Mr. Nammo was to become a 50% partner in the trucking business in exchangefor using his name, financial history, and expertise to secure the necessary business loan. Mr.

Nammo saw this as a good businessopportunity and says that over the next year he and his partner spent a significant amount of time drafting a business plan and locatingthe first truck to purchase. [6] With the plan and opportunity in hand, they went to the Royal Bank of Canada (RBC) to secure a business loan. The applicantsays that “the bank agreed to process the loan pending a credit check”. I do not accept the submission of the respondent that there was noevidence that the loan would have been approved save for the faulty information it provided to RBC.

Aside from the sworn evidence ofthe applicant to that effect, I find it extremely unlikely that a bank would ask for a credit check in circumstances where it had not decidedto advance the loan requested. [7] Mr. Nammo says that the day after the loan application was submitted, he was informed by RBC that the loan had not beenapproved because he had “bad credit” and his partner did not have a financial background sufficient to support a loan of the necessaryamount on his own credit. The credit information had been supplied to RBC by TransUnion. When Mr. Nammo asked what the issues

were that affected his credit, he learned, in a phone call with TransUnion on January 3, 2008, that the negative credit decision stemmed from information TransUnion had on its report that was received from a collection agency, CBV Collection Services Ltd. (CBV). [ 8 ] Mr. Nammo contacted CBV and was told that the information it had supplied to TransUnion related to someone other than Mr. Nammo. Mr. Nammo then contacted TransUnion by telephone on January 4, 2008, seeking to have his record corrected. [ 9 ] Mr.

Nammo was understandably upset when he called TransUnion and it is fair to say that he was testy in the telephone conversations he had with representatives of the respondent. He was seeking an immediate response, but TransUnion needed time to investigate his allegation that false information had been placed on his file. [ 10 ] TransUnion launched an investigation as a result of Mr. Nammo’s calls.

TransUnion says that it conducted a “full investigation”, the entire scope of which appears to have been one telephone call made on January 23, 2008, some 20 days after receiving the complaint, between a representative of TransUnion and “Shirly” at CBV. Shirly confirmed that the credit information sent to TransUnion by CBV did not relate to Mr. Nammo but was about a different person. That same day TransUnion responded to Mr. Nammo’s complaint, as follows: This letter is written in response to your recent request regarding the accuracy of certain information in your credit file.

We have confirmed your information and based on these findings, have amended your credit file to reflect this information. Please note that we have notified Royal Bank of the change to your file. [ 11 ] The letter notifying RBC of the change to Mr. Nammo’s file was also sent by TransUnion on January 23, 2008. It read as follows: Following your inquiry on January 03, 2008 please be advised that we have made an amendment to your client’s credit file.

The contact details for your client are as follows: MIRZA NAMMO 2410 14 ST SW Calgary AB T2T 3T6 If you wish to review the results of our investigation, we recommend that you request a copy of your client’s credit file. The record indicates that TransUnion also sent virtually identical letters to two other institutions to whom it had sent credit reports on Mr. Nammo as a result of credit inquiries they made on December 17, 2007 and July 6, 2007. [ 12 ] Mr. Nammo, upon receiving the January 23, 2008 letter from the respondent, tried to discover how inaccurate information had been placed on his file.

His discussions with CBV led him to conclude, correctly, that it was not their fault. CBV told Mr. Nammo that the information they supplied to TransUnion related to a man with a different name, a different date of birth, a different Social Insurance Number, living in a different province and who had never lived at any of the addresses where Mr. Nammo had lived. It must be noted that TransUnion had not been provided with the Social Insurance Number or current province of residence of this third party, whom I shall refer to as Mr.

X. [2] [ 13 ] The information that TransUnion did receive from CBV had some passing similarity to the name and address information it had collected on Mr. Nammo. [ 14 ] Mr. Nammo had legally changed his name to Mirza Nammo in 1999. TransUnion’s records on him listed three variations of his previous name. Mr. X’s first name was one letter different than his previous first name and his last name had one less letter than one of the last names of the applicant in the respondent’s database. [ 15 ] The address for Mr.

X was on a Calgary street where the applicant had formerly lived, but was not at the same street number. The difference between the street numbers was less than 100. The respondent pointed out that the postal codes of the two addresses were identical save for the last digit; however, given how postal codes are assigned, that is only indicative of the close proximity of the two residences. [ 16 ] The information provided to TransUnion by CBV contained one striking dissimilarity: their dates of birth. The applicant was born on July 21, 1966, and is 44 years old. Mr.

X was born in 1982 and is 28 years old. [ 17 ] Armed with the information he received from CBV, on February 1, 2008, Mr. Nammo wrote to the respondent asking a series of questions attempting to determine how the error had happened. [ 18 ] On February 15, 2008, TransUnion responded by letter. It is a challenge to determine whether its response was mere obfuscation or, as was suggested by the applicant, deliberate misrepresentation.

In the letter TransUnion took no responsibility for the error which was its and its alone; rather, it stated that CBV had reported the account in error, implying that the fault lay with CBV: When you contacted TransUnion on January 4, 2008, you requested an investigation into one of the cross references appearing on your file as well as a Canadian Tire MasterCard account and a CBV Collection Services account. At that time, TransUnion conducted a full investigation and the results of this investigation were mailed to your attention on January 23, 2008.

In that letter, you were advised that we had amended your credit file and had advised the applicable creditors of the change. In regards to the collection account that was reporting on your file, CBV Collections confirmed that they had reported the account in error to TransUnion. We removed the account from your file on January 23, 2008 and advised you of its removal in our letter of the same date. We enclose a copy of your updated credit file, for your review. [Emphasis added.]

[ 19 ] Not satisfied with this response, the applicant filed a complaint with the PCC. The PCC concluded that: Clearly TransUnion failed in its obligation under [clause] 4.6 [of

Schedule 1 to PIPEDA ] to maintain accurate information about the complainant. In the circumstances, the failure by TransUnion to maintain accurate information about the complainant had serious adverse effects on the complainant. TransUnion has thus failed to meet the standard set in [clause] 4.6.1. In my view, TransUnion’s swift investigation, its action to amend the complainant’s credit file and its report to the bank meet the requirements of [clause] 4.9.5. Accordingly, I conclude that the complaint is well-founded and resolved.

Issues and Analysis [ 20 ] The applicant raises a number of issues in his memorandum of fact and law. He notes that the PCC found TransUnion to have violated clauses 4.6 and 4.6.1. He submits that unauthorized access to his file and the placing of someone else’s information in it violates clauses 4.7 and 4.7.1. He submits that if the protocol TransUnion uses to match incoming information with individuals’ files in its database included a unique identification number, such as a Social Insurance Number, the mistake that was made would not have occurred. Mr.

Nammo says he asked TransUnion to send him the document it received from CBV that allegedly contained information about him but that TransUnion refused, in violation of clause 4.9.4. He disputes the PCC’s finding that TransUnion was in compliance with clause 4.9.5, saying that TransUnion deliberately wasted time and refused to acknowledge its mistake. Mr. Nammo further alleges that TransUnion violated clause 4.10.2 and 4.10.4 by failing to respond to his specific questions regarding the inaccuracy and why it happened. [ 21 ] Mr. Nammo notes that

section 16 of PIPEDA empowers the Federal Court to order damages and to order an organization to correct its practices. He says that changing TransUnion’s practices to ensure compliance with the law would be easy because individuals are provided with unique identifiers, such as Social Insurance Numbers and driver’s licence numbers, which if used by TransUnion would avoid mistakes. Lastly, he submits that TransUnion has demonstrated a failure to understand Alberta’s Fair Trading Act and submits that the Court should award him damages under

section 50 of that Act. [ 22 ] Some of the issues articulated by the applicant may be disposed of in short order because the Court lacks jurisdiction to deal with them. The principal issues of whether TransUnion breached PIPEDA and the remedy to be ordered if it did so does fall squarely within the Court’s jurisdiction. Issues not within the Court’s jurisdiction [ 23 ] TransUnion is correct that the Federal Court does not have jurisdiction to grant a remedy under the Alberta Fair Trading Act , a provincial statute. As a statutory court, the Federal Court enjoys only the jurisdiction given to it by statute.

Neither the Federal Courts Act , R.S.C., 1985, c. F-7 [ s. 1 (as am. by S.C. 2002, c. 8 , s. 14)], nor PIPEDA gives this Court authority over the Fair Trading Act . [ 24 ] TransUnion is also correct that this Court does not have jurisdiction to find it to be in breach of clause 4.10.

Section 14 of PIPEDA empowers a party to apply to the Federal Court for a hearing in respect of the clauses of

Schedule I specifically identified in

section 14. Clause 4.10 is not listed in

section 14 and thus the Court has no jurisdiction to consider it. [ 25 ] I also agree with TransUnion that under

section 14 of PIPEDA this Court does not have jurisdiction to consider matters that were not complained of to the PCC or were not referred to in its report. [ 26 ] TransUnion correctly notes that the applicant’s submission that TransUnion did not provide him with a document he requested, contrary to clause 4.9.4, was not raised in the notice of application, and submits that the Court should refuse to hear it. I agree. Not only was the issue not raised in the notice of application; it does not appear that the applicant ever properly requested the document under PIPEDA as no written request for it was ever made.

Subsection 8(1) of PIPEDA makes it clear that a request for such a document must be in writing. In the January 3 and 4, 2008 telephone conversations the applicant was told to make his request in writing. The “request” he relies on is his letter of February 1, 2008, which requests general information about the cause of the inaccuracy but does not specifically ask for the document TransUnion received from CBV. [3] That letter fails to meet the test of a written request for the document as it fails to identify the document being requested.

Issues within the Court’s jurisdiction [ 27 ] TransUnion says the only issue properly before the Court is the issue of the accuracy of the information because the PCC decision only addressed the issue of accuracy and only applied clauses 4.6, 4.6.1, and 4.9.5, and because the applicant has not demonstrated the non-accuracy related claims are properly before this Court. The non-accuracy related claims of the applicant relate to Principles 7 [clause 4.7] and 9 [clause 4.9] dealing with safeguards and access to information. [ 28 ] The language of

section 14 granting jurisdiction to this Court is broad. It provides that a complainant may apply to the Federal Court for a hearing “in respect of any matter in respect of which the complaint was made” (emphasis added). In my view, “any matter” refers to the factual subject matter underlying the complaint, not the legal characterization of the factual issues raised as falling under a particular principle or clause. The decision of the PCC to apply or not apply certain principles or clauses in rendering a decision cannot deprive an applicant of the ability to make submissions to this Court regarding other principles and clauses, especially considering that an application under

section 14 is not a judicial review but a de novo hearing. [ 29 ] It is submitted by Mr. Nammo that TransUnion breached Principle 6 — Accuracy, because the personal information it kept on him was not “as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used” as described in clause 4.6.

[ 30 ] Clause 4.6, the Accuracy principle, has not been interpreted by this Court. TransUnion urges the Court to interpret the Accuracy principle “in a way that coalesces the Accuracy principle and the remedy in [clause] 4.9.5”. Clause 4.9.5 provides that “[w]hen an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.” TransUnion submits that the Court should find that there has not been a breach of the Accuracy principle where an organization responded adequately to correct the allegedly inaccurate information.

It submits that there are two scenarios wherein it might be found that the organization’s response has not been adequate: a failure to meet industry standards or a failure to respond within a reasonable time. It makes the following submission: A breach of the Accuracy principle may be found if an organization’s accuracy practices fall below the industry standard for accuracy given the intended use of the information.

A breach may also be found where an organization is notified of inaccurate information pursuant to [clause] 4.9.5, but fails to correct the inaccuracy within a reasonable period of time. [ 31 ] I do not accept TransUnion’s

interpretation; it is not tenable on either a reading of the specific language of clauses 4.6 and 4.6.1 or the overall purpose of PIPEDA . Just because an organization has taken steps to correct a breach does not mean that the breach did not occur. Rectification of the breach is something that is more properly a factor to consider when determining what remedy, if any, this Court should award under

section 16 of PIPEDA. In my view, the correct

interpretation of PIPEDA requires that clause 4.9.5 be viewed as an independent requirement, not as an escape hatch to be read into clause 4.6. [ 32 ] The

interpretation TransUnion proposes, incorporating the timeliness of an organization’s correction into clause 4.6, is also untenable because it would require that an organization be notified under clause 4.9.5 before a breach could be considered to have occurred. This requirement appears nowhere in the language of clause 4.6 or 4.6.1.

Clause 4.6 provides that personal information shall be “as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.” Clause 4.6.1 provides that “[i]nformation shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about the individual.” Neither clause provides that the time to assess the accurateness, completeness and currency of the information is after one has been informed that it is not accurate, complete or current. [ 33 ] TransUnion’s suggestion that a breach may be found only if an organization’s accuracy practices fall below industry standards is also untenable.

The logical conclusion of this

interpretation is that if the practices of an entire industry are counter to the principles laid out in

Schedule 1, then there is no breach of PIPEDA . This

interpretation would effectively deprive Canadians of the ability to challenge industry standards as violating PIPEDA. [ 34 ] PIPEDA recognizes the reality that organizations collect, use, and disclose personal information. The acceptable purposes for collection, use and disclosure are those described in

section 3 of PIPEDA, namely those that “a reasonable person would consider appropriate in the circumstances.” These are not necessarily the standards set by or for an industry. In this respect, I agree with the following statement of the PCC in its Report: TransUnion has taken the position that it acted at all times in accordance with the Alberta Fair Trading Act and

section 3.3(2) of the Credit and Personal Reports Regulation of the Act . It takes the position that [ PIPEDA ] has no application in these circumstances. I disagree. [PIPEDA] sets out independent obligations that must be respected by all organizations covered by the Act. The fact that TransUnion may have respected its obligations under the Fair Trading Act does not mean that it can ignore the obligations under [PIPEDA]. Lastly, I note that nowhere in the Accuracy principle or in

Schedule 1 is there any reference to industry standards. If all industries had standards that equalled the scheme in PIPEDA , then the Act would have been unnecessary. To now tie the two together would be to neuter the Act and its impact. [ 35 ] TransUnion provided a general overview of the electronic process it uses to match information received by it to the files on individuals that it creates and maintains. It is a computerized process that does not require an exact match.

TransUnion says that it is unreasonable to expect a credit reporting organization to place information on an individual’s file only when there is an exact information match given the problems inherent in administering an exact match system. It further submits that while each Canadian has a unique Social Insurance Number, the numbers are not available to be used for this purpose. [ 36 ] I agree with TransUnion on this last point. Social Insurance Numbers are unique to each individual; they are used to administer the Canada Pension Plan.

Only specific government departments and programs are authorized to collect and use Social Insurance Numbers; the respondent and similar businesses are not so authorized. [ 37 ] I also accept the submission of TransUnion that it is not commercially reasonable for credit reporting agencies to adopt an exact match system. It is evident from the record that information supplied to credit reporting agencies may contain some identical information relating to an individual but it is unlikely to contain completely identical information.

For example, agencies collect information that includes former residential addresses and aliases used by an individual. Exact matching would limit such matching and make the value of the information collected questionable in many circumstances. There is a value to credit information not only for the lender but also for the borrower whose personal information is contained in the credit report. An exact match system could be a disservice to both. [ 38 ] The use of a partial match system may, from time to time, result in matching errors.

However, it does not follow that the collector of information under such a system can escape responsibility under PIPEDA merely because that system is the commercially sensible one. The practical necessity of administering a partial match system does not mean that the Accuracy principle can never be breached or that it has not been breached in this case.

There is no defence of practical necessity set out in PIPEDA. [ 39 ] PIPEDA does not require that personal information be completely accurate, complete, and up-to-date; rather, it requires that personal information be as accurate, complete, and up-to-date “as is necessary for the purposes for which it is to be used.” Thus, it is the use that the information is put to that dictates the degree of accuracy, completeness, and currency the information must have. [ 40 ] Credit information, such as that supplied by TransUnion, has one use: to allow credit grantors to make informed, reliable and objective decisions.

Informed, reliable and objective decisions require that the information on which the decisions are based meets a

high standard of accuracy, completeness and currency. This role of credit information and credit agencies such as TransUnion wasdescribed by Justice Feldman of the Ontario Court of Appeal in Haskett v. Equifax Canada Inc., , 63 O.R. (3d) 577,at paragraph 29, as follows: Credit is an integral part of everyday life in today's society.

Not only people seeking loans, mortgages, insurance or car leases, but thosewho wish, for example, to rent an apartment or even obtain employment may be the subject of a credit report, and its contents could wellaffect whether they are able to obtain the loan, the job or the accommodation. Credit cards are a basic form of payment but theiravailability is also limited by one's creditworthiness. Without credit, one is unable to conduct any financial transactions over thetelephone or on the internet.

As credit is so ubiquitous, there is nothing exceptional about consumer reliance on credit reporters to carryout their function not only honestly, but accurately, with skill and diligence and in accordance with statutory obligations. [Emphasisadded; footnote omitted.] [41] The information TransUnion had in its database concerning the applicant and, more importantly, that it provided to RBC, mayhave been complete and up-to-date; however, it was not accurate.

It was grossly inaccurate. [42] It appears to the Court that a human check of the information prior to transmitting it to RBC would most likely have stopped thefalse information being transmitted to RBC. It did not require a close examination of the information from CBV to conclude that it hadbeen improperly placed on Mr.

Nammo’s file. [43] I find that the applicant’s personal information in the possession of TransUnion was not “as accurate, complete, and up-to-date asis necessary for the purposes for which it is to be used” (clause 4.6) and was not “sufficiently accurate, complete, and up-to-date tominimize the possibility that inappropriate information may be used to make a decision about the individual” (clause 4.6.1).

I agree withthe findings of the PCC that TransUnion failed to meet its obligations under clauses 4.6 and 4.6.1 and thus breached PIPEDA. [44] For the reasons previously noted, I do not agree with TransUnion that the safeguarding issue under Principle 7 is not properlybefore the Court. However, I find that TransUnion did not breach Principle 7. That principle requires that personal information beprotected by security safeguards appropriate to the sensitivity of the information.

Here the information was secure and protected; it wasdeliberately disclosed to RBC as part of TransUnion’s normal business practices and with the consent of the applicant. There was no lossor theft, nor any unauthorized access, disclosure, copying, use or modification as described in clause 4.7.1, at least not concerning thisapplicant—it was not his personal information, even though it was stored under his name. Mr. X, whose information was improperlystored and disclosed, may have a valid complaint against TransUnion that his information was not properly safeguarded, but Mr.

Nammodoes not. [45] Clause 4.9.5 requires that if it has been demonstrated that personal information held by an organization is inaccurate, as it washere, then the organization “shall amend the information as required.” TransUnion amended the inaccurate information in its files and tothat extent met its obligation under clause 4.9.5. [46] Clause 4.9.5 further provides that “[w]here appropriate, the amended information shall be transmitted to third parties havingaccess to the information in question.” TransUnion submits that it transmitted the amended information to relevant third parties in atimely manner, and accordingly did not breach clause 4.9.5. [47] The Court must address two issues: was it “appropriate” in the circumstances that TransUnion provide the corrected informationto those to whom it had previously disclosed the inaccurate information and, if so, was it done? [48] In my view, there can be no question that it was appropriate to correct the false credit information that had been provided earlier.The fact that TransUnion took steps to do so with these three institutions indicates that it thought the correction was appropriate.Information, especially of a financial nature, is unlikely to be obtained, used once and discarded.

It is more likely that a credit-grantinginstitution will maintain the credit information obtained as a part of the record it has established relating to the credit application.Accordingly, it is very likely that false information will be stored and there is a corresponding risk that it may be accessed and usedagain.

This is a serious risk because if it is used again then the consequences of having provided the false information are exacerbated.This risk requires that the record be corrected. [49] Having found that there is an obligation on TransUnion to set the record straight, the Court must then ask whether the letter sentby TransUnion did so. For ease of reference I set out again the letter sent to RBC by TransUnion: Following your inquiry on January 03, 2008 please be advised that we have made an amendment to your client’s credit file.

The contactdetails for your client are as follows: MIRZA NAMMO 2410 14 ST SW Calgary AB T2T 3T6 If you wish to review the results of our investigation, we recommend that you request a copy of your client’s credit file. [50] Can it be said that by this letter TransUnion transmitted the “amended information” to RBC, as is required under clause 4.9.5? Ithink not. It informed RBC that the information had been amended but did not send it the amended information. No details wereprovided to RBC of the “amendment” to its client’s file. TransUnion did not even include an updated credit report on Mr. Nammo.

CouldRBC have determined that the information on which it had based the loan refusal was inaccurate? Again, I think not. The letter does noteven indicate that false information had been removed, only that “an amendment” to the file had been made. Given the lack ofinformation that TransUnion sent to RBC, stating that the record had been amended could have been interpreted to mean that additionalinstances of default in payment had been added. The amended information that TransUnion was required to transmit to RBC under clause4.9.5 was a copy of the credit report for Mr.

Nammo as it appeared in its records after the CBV entry had been removed.

[ 51 ] At the hearing Mr. Nammo suggested that the manner in which TransUnion responded to RBC, recommending that it request the amended credit report, meant that RBC would have to pay TransUnion a fee to obtain the corrected report. There was no evidence in the record suggesting that TransUnion would have provided the corrected report free of charge and there is nothing in its letter to RBC to that effect. Charging the recipient of false information sent by TransUnion for the corrected information would be outrageous in my view, and most certainly contrary to clause 4.9.5.

The inference that the corrected information would only be provided on payment of a fee would likely result in the information not being requested because the transaction for which it was sought was at an end.

Remedy [ 52 ] The applicant is seeking two remedies: a “procedural review” of the respondent’s methods of work to determine how incorrect financial data was placed by it on his credit file, and damages for the losses suffered as a result of TransUnion providing false credit information to RBC and for the stress, mental anguish and embarrassment it caused him. [ 53 ] I am not convinced that the procedural review sought is necessary in order to determine how the inaccurate information was placed on the applicant’s file.

It is clear that the information was incorrectly placed on his file because of the inexact matching parameters used by TransUnion. It is also clear to me that the incorrect information was sent to RBC and others because there was no independent check of the information beforehand. [ 54 ] TransUnion urged the Court not to award damages to the applicant even if breaches of PIPEDA were found. It submits, firstly, that damages are within the discretion of the Court and it points out that to date there have been no damage awards made under

section 16 of PIPEDA. I agree that the Court has a discretion under

section 16 as the

section provides that the “Court may … award damages” (emphasis added); it is not required to do so. [ 55 ] TransUnion secondly submits that the test for whether or not a breach of PIPEDA gives rise to liability in damages should be founded on the concept of reasonableness. It says that the Court should consider and be guided by the respondent’s conduct throughout the events giving rise to the breach. If its conduct was reasonable, then no damages ought to be awarded.

It submits that the commentary of Allen Linden and Bruce Feldthusen in Canadian Tort Law , 8th ed. (Markham, Ont.: LexisNexis Butterworths, 2006), at page 130, which speaks to the need to balance interests when assessing liability under the law of negligence, applies equally to a finding of liability under

section 16 of PIPEDA: If every act involving danger to someone entailed liability, many worthwhile activities of our society might be too costly to conduct. The law of negligence seeks to prevent only those acts which produce an unreasonable risk of harm. In measuring whether the hazard is an unreasonable one, the court balances the danger created by the defendant’s conduct, on one hand, and the utility of that conduct, on the other hand.

If the hazard outweighs the social value of the activity, liability is imposed; if it does not, the defendant is exonerated. [Emphasis in original.] [ 56 ] I accept that an assessment of a respondent’s conduct is appropriate when a court is exercising its discretion to award damages and in considering the quantum of damages; however, TransUnion’s submission appears to confuse liability with damages. The passage cited above outlines that not all conduct that creates a risk of harm is negligent—only conduct that creates an unreasonable risk of harm is negligent and attracts liability.

Similarly, under PIPEDA it is not all inaccurate personal information that creates a breach of the Act— it is only that which is insufficiently accurate given the purpose for which it is used. Therefore, the “reasonableness” test has been built into the Act and is considered when determining whether there has been a breach of the legislative provisions. [ 57 ] TransUnion thirdly submits that it should only be found liable for damages under

section 16 of PIPEDA if the applicant “establishes that TransUnion’s conduct was unreasonable”. It says that “given that the Accuracy principle is balanced by sub-paragraph 4.9.5, the Court should also give weight to TransUnion’s efforts to remedy the inaccuracy”. As stated previously, I agree that an assessment of a respondent’s conduct is appropriate when a court is exercising its discretion to award damages and in considering the quantum of damages.

In examining the reasonableness of conduct where there has been a breach of the Accuracy principle, it is appropriate that the Court be guided by a number of factors including the nature of the response to the complaint, the steps taken to investigate the allegation of inaccuracy, the steps taken to correct the information collected in an organization’s own records, the steps taken to correct false information the organization has provided to others, the steps taken to keep the individual informed of actions taken, and the timeliness of all steps taken. [ 58 ] TransUnion fourthly submits that when the inaccurate personal information relates to personal credit information, the person whose information it is also bears a responsibility for its accuracy.

With respect to Mr. Nammo, it makes the following submission: … Nammo had the capacity, and a degree of responsibility, to reduce the risk of inaccurate information appearing on his file. The public is encouraged to check their credit files, particularly when they anticipate applying for credit.

Nammo knew he could get a credit report, knew he was responsible for acquiring financing under his name, knew from his prior experience that it was possible for disputable information to be placed on his file, accepted that inaccurate information could be placed on his file, but failed to check his credit file prior to applying for the loan. As such, he should have reduced the potential for inaccuracy by checking his credit prior to applying for a loan. [ 59 ] The record reveals that many years prior to the events giving rise to this application, Mr.

Nammo discovered that a credit reporting agency other than the respondent had a record of an unpaid bill from a dentist on his file. Mr. Nammo had refused to pay the dentist’s bill as the services for which the dentist had billed him had not been performed. The record was subsequently amended by the credit reporting agency. Accordingly, the respondent is correct that Mr. Nammo knew that false information could be placed on his credit record.

However, I can find no support in the record for its assertion that he “ accepted that inaccurate information could be placed on his file” unless it is meant that he understood that it could happen. I agree with the observation of the Ontario Court of Appeal in Haskett v. Equifax Canada Inc ., above [at paragraph 27] , that “[t]o the extent that a person such as the appellant authorizes, either expressly or impliedly, the gathering and reporting of credit information … it is fair to say that any such authorization would normally be limited to accurate and non-negligent reporting.” [ 60 ] The circumstances of Mr.

Nammo’s dispute with his dentist some years ago and the situation before this Court are completely

different. In the former, a bill had been sent and was unpaid because the charges were challenged. Nonetheless, the information did relate to Mr. Nammo and did relate to a bill delivered to him that he had not paid. The information here did not relate in any way to Mr. Nammo. [ 61 ] To suggest, as the respondent has, that one should check one’s credit record before applying for a loan to ensure an agency has not wrongly placed another’s information on it can only be said to be a reasonable thing to do if credit reporting agencies are notorious for attributing false information to credit files.

TransUnion, not surprisingly, has not made that submission. If reports from credit reporting agencies were frequently inaccurate, they would soon be out of business. I do not accept that Mr. Nammo shares any responsibility for the error made by the respondent and, frankly, I find its attempt to shift any of the blame to Mr. Nammo to be offensive. [ 62 ] TransUnion fifthly submits that it resolved the inaccuracy “swiftly” and thus an award of damages is inappropriate. I do not share its view that the inaccuracy was resolved swiftly.

It took TransUnion 20 days to make one phone call to determine that the information it had placed on Mr. Nammo’s file was not his. In Neil v. Equifax Canada Inc. , 2006 SKQB 169 , 277 Sask. R. 275, the Court found [at paragraph 12] that a delay of 11 business days to conduct an investigation was not reasonable when “[b]y checking its own records the appellant could have discovered the error.” The same is true here. First, as I have previously stated, the error was evident on the face of TransUnion’s own records because the dates of birth were so significantly different.

Second, TransUnion has offered no explanation as to why it took 20 days to make a single phone call to CBV to inquire whether the information it supplied related to Mr. Nammo. I find that TransUnion corrected its errors neither swiftly nor within a reasonable period of time. [ 63 ] I have already rejected TransUnion’s sixth submission that there is no evidence that Mr. Nammo would have received the loan but for its inaccurate information having been provided to RBC. [ 64 ] TransUnion lastly submits that Mr.

Nammo has failed to prove any loss arising from the failure to secure the loan and, in any event, has failed to mitigate any loss he may have incurred. I agree. [ 65 ] The only evidence offered by the applicant to support his alleged loss of business profits was financial statements from his former business partner for the months October 2008 and September 2009. It is inappropriate to ask this Court to extrapolate from this limited information what the proposed business would have earned over any extended period of time. Equally, it is not established what expenses the business would have incurred.

I agree with the respondent that “on the evidence, it is impossible for the Court to determine [the applicant’s] alleged losses without creating an arbitrary valuation scheme”. Accordingly, no damages are awarded to Mr. Nammo for the lost profits he alleges were incurred as a result of the breaches of PIPEDA by the respondent. [ 66 ]

Section 16 of PIPEDA provides that “[t]he Court may, in addition to any other remedies it may give … award damages to the complainant, including damages for any humiliation that the complainant has suffered.” This provides the Court with exceptionally broad power to award damages. Nevertheless, any damages awarded must be awarded on a principled basis, and be appropriate and just in the circumstances. [ 67 ] Let me turn first to the claim for damages for humiliation. In his cross-examination Mr. Nammo was asked about his claim that he had suffered anguish and stress.

He did not see a doctor but he does explain that the actions of TransUnion caused him stress and anxiety. Much of what he describes relates to the PCC process and to his application to this Court. However, he also says that he wants to clear his name and that he has still not been able to prove to his prospective business partner that he does not have a bad credit rating. [ 68 ] I am satisfied that in the circumstances experienced by Mr. Nammo it would be the exceptional person who would not be humiliated.

He had partnered with a friend to undertake a business; his role was to secure financing because he was creditworthy while his friend was not, and the loan was approved subject to the credit check, which came back indicating that Mr. Nammo had poor credit. Mr. Nammo then had to inform his partner of this result. Although he said to his partner that the information was wrong, the credit reporting service said that it would take up to 30 days to investigate, during which time the opportunity and partnership were lost.

In addition, RBC officials were provided with information that led them to conclude that the applicant was not a good credit risk. The reasonable person, knowing that the assessment made of his creditworthiness must be incorrect, would be humiliated at having to face and to protest to both his prospective partner and to bank officials.

The reasonable person would suffer additional humiliation when the error was not clearly corrected by informing RBC and the credit applicant that an error was made, that there was no debt owed by the applicant, and that the error had been corrected. [ 69 ] A credit reporting agency such as TransUnion would know that false information it provides showing a person to have unpaid debts would adversely affect that person’s ability to secure a loan. It would also know that in such circumstances the person seeking credit would be humiliated when his credit application was rejected.

Where the credit reporting service has failed to take prompt, reasonable steps to correct the record and to therefore ameliorate the embarrassment of the individual, it should expect that it will be ordered to compensate him for the humiliation it has caused. A credit reporting agency makes a profit from trading in the personal information of others. Such business, perhaps more so than others, ought to be aware of the need for accuracy and prompt correction of inaccurate information.

Such businesses should expect to be held to account when they fail to do so. [ 70 ] In this case, I find that TransUnion failed to take prompt, reasonable steps to correct the record and reverse the situation it had caused; rather, it exacerbated the situation through the actions it took and the actions it failed to take: (

i) It failed to accept responsibility for its actions when it informed Mr. Nammo of the error’s correction but suggested it was the fault of another company, CBV; (ii) It failed to unambiguously inform RBC and the two other financial institutions that the information previously sent to them indicating that Mr. Nammo had an outstanding debt in default was wrong; (iii) It failed to correct the record with RBC and the two other financial institutions by sending a copy of Mr. Nammo’s corrected credit report;

(iv) It failed to take prompt action to examine its own records to ascertain if they contained an obvious error; and (

v) It failed to take prompt action to investigate whether an error had occurred. [71] As indicated, PIPEDA provides the Court broad remedial powers and, in my view,

section 16 of PIPEDA permits the Court, in anappropriate case, to award damages even when no actual financial loss has been proven. In Randall v. Nubodys Fitness Centres, 2010 FC681, 371 F.T.R. 180, Justice Mosley found [at paragraph 55] that an award of damages under

section 16 is not to be made lightly and thatsuch an award should only be made “in the most egregious situations.” This is such a situation.

In Randall, which involved the disclosureof how often the applicant used his gym membership to his former employer, Justice Mosley determined that the impugned disclosure ofpersonal information was “minimal”, that there had been no injury to the applicant sufficient to justify an award of damages, that therespondent did not benefit commercially from the breach of PIPEDA, that the respondent did not act in bad faith, and, perhaps mostimportantly, that there was no link between the disclosure and the employer’s alleged retaliation against the applicant. The same cannotbe said here.

Not only was the disclosure of inaccurate information directly linked to the refusal of the loan and the associated injury tothe applicant, but the respondent also profited from the disclosure and acted in bad faith in failing to take responsibility for its error andfailing to rectify the problem in a timely manner. The violation of Mr. Nammo’s rights under PIPEDA was not “the result of anunfortunate misunderstanding”, as was the case in Randall [at paragraph 58]. It was a serious breach involving financial information ofhigh personal and professional importance.

The fact that there is no precedent for an award of damages under PIPEDA should not impactthe Court from making an award of damages where the circumstances and justice demands it. In my view, for the reasons that follow,this is such a case. [72] In Vancouver (City) v. Ward, 2010 SCC 27, [2010] 2 S.C.R. 28, the Supreme Court [at paragraph 72] awarded damages for abreach of the Charter [Canadian Charter of Rights and Freedoms, being

Part I of the Constitution Act, 1982,

Schedule B, Canada Act1982, 1982, c. 11 (U.K.) [R.S.C., 1985, Appendix II, No. 44]] even though it found that the breach was not “intentional, in that it was notmalicious, high-handed or oppressive” and even though no financial loss had been proven. The Supreme Court addressed the differentgoals of awarding damages for a Charter breach; these include compensation, for which loss is relevant, but also vindication anddeterrence, for which loss is not a determinative factor. At paragraphs 25 and 30, the Court wrote that: For damages to be awarded, they must further the general objects of the Charter.

This reflects itself in three interrelated functions thatdamages may serve. The function of compensation, usually the most prominent function, recognizes that breach of an individual’sCharter rights may cause personal loss which should be remedied. The function of vindication recognizes that Charter rights must bemaintained, and cannot be allowed to be whittled away by attrition.

Finally, the function of deterrence recognizes that damages mayserve to deter future breaches by state actors. [Emphasis in original.] … However, the fact that the claimant has not suffered personal loss does not preclude damages where the objectives of vindication ordeterrence clearly call for an award.

Indeed, the view that constitutional damages are available only for pecuniary or physical loss hasbeen widely rejected in other constitutional democracies… [Emphasis added.] [73] At paragraphs 51–52, the Court explained the process for arriving at the quantum of damages: When we move from compensation to the objectives of vindication and deterrence, tort law is less useful. Making the appropriatedeterminations is an exercise in rationality and proportionality and will ultimately be guided by precedent as this important

chapter ofCharter jurisprudence is written by Canada’s courts. That said, some initial observations may be made. A principal guide to the determination of quantum is the seriousness of the breach, having regard to the objects of s. 24(1) damages. Theseriousness of the breach must be evaluated with regard to the impact of the breach on the claimant and the seriousness of the statemisconduct: see, in the context of s. 24(2), R. v. Grant, 2009 SCC 32, [2009] 2 S.C.R. 353.

Generally speaking, the more egregious theconduct and the more serious the repercussions on the claimant, the higher the award for vindication or deterrence will be. [74] The Supreme Court found [at paragraph 54] that “to be ‘appropriate and just’, an award of damages must represent a meaningfulresponse to the seriousness of the breach and the objectives of compensation, upholding Charter values, and deterring future breaches.”In my view, the same reasoning applies to a breach of PIPEDA, which is quasi-constitutional legislation. [75] In Lavigne v.

Canada (Office of the Commissioner of Official Languages), 2002 SCC 53, [2002] 2 S.C.R. 773, the SupremeCourt held that the Privacy Act, R.S.C., 1985, c. P-21, was quasi-constitutional legislation that must be interpreted with its specialpurposes in mind. In Eastmond v. Canadian Pacific Railway, 2004 FC 852, 16 Admin.

L.R. (4th) 275, at paragraph 100, Justice Lemieuxconfirmed that PIPEDA also enjoys quasi-constitutional status: I have no hesitation in classifying PIPEDA as a fundamental law of Canada just as the Supreme Court of Canada ruled the federalPrivacy Act enjoyed quasi-constitutional status (see Justice Gonthier’s reasons for judgment in Lavigne v.

Canada (Office of theCommissioner of Official Languages, 2002 SCC 53 , [2002] 2 S.C.R. 773 at paragraphs 24 and 25. [76] Applying the Supreme Court’s reasoning in Ward to PIPEDA applications before this Court indicates that both the question ofwhether damages should be awarded and the question of the quantum of damages should be answered with regard to whether awardingdamages would further the general objects of PIPEDA and uphold the values it embodies.

Furthermore, deterring future breaches and theseriousness or egregiousness of the breach would be factors to consider. [77] One of the central objects of PIPEDA is to encourage those who collect, use and disclose personal information to do so with adegree of accuracy appropriate to the use to which the information is to be put and to correct errors quickly and effectively. I have foundthat TransUnion failed to collect accurate information on the applicant. Further, when apprised of its error, it failed to address thecomplaint quickly and effectively.

It further failed to quickly and effectively correct the inaccurate information it had disseminated.Lastly, it failed to take responsibility for its error, first blaming CBV, and then in this action attempting to attribute some blame to theapplicant. In my judgment, these are circumstances that warrant an award of damages based on the considerations of vindication and

deterrence. [ 78 ] In Ward , the trial judge had awarded damages of $5 000. The quantum of that award was upheld by the Supreme Court as appropriate. In so doing, the Supreme Court described the nature of the breach of Mr. Ward’s rights, which involved him being stripped searched, as follows [at paragraph 71]: The object of compensation focuses primarily on the claimant's personal loss: physical, psychological, pecuniary, and harm to intangible interests. The claimant should, in so far as possible, be placed in the same position as if his Charter rights had not been infringed.

Strip searches are inherently humiliating and thus constitute a significant injury to an individual’s intangible interests regardless of the manner in which they are carried out. That said, the present search was relatively brief and not extremely disrespectful, as strip searches go. It did not involve the removal of Mr. Ward’s underwear or the exposure of his genitals. Mr. Ward was never touched during the search and there is no indication that he suffered any resulting physical or psychological injury. While Mr. Ward’s injury was serious, it cannot be said to be at the high end of the spectrum.

This suggests a moderate damages award. [ 79 ] In my assessment, much the same can be said in this case. Although the dissemination of false credit information is not a strip search, it does lay bare to those receiving the information the creditworthiness of a person. In my assessment, it can be as equally intrusive, embarrassing and humiliating as a brief and respectful strip search. Accordingly, I have determined that Mr. Nammo is entitled to an award of damages of $5 000, inclusive of the humiliation he suffered as a result of the breaches of PIPEDA by TransUnion. [ 80 ] Mr.

Nammo is also entitled to a declaration that his rights under PIPEDA were breached by TransUnion, and he is entitled to a declaration that TransUnion forwarded inaccurate financial information concerning him to RBC; hopefully this will assure his potential business partner that the reason for the rejection of the loan application had nothing to do with his creditworthiness. [ 81 ] Mr. Nammo was self-represented. He did an admirable job for one unskilled in the law.

While he cannot recover costs for legal fees, as none were expended, he is entitled to recover his disbursements, which I fix at $1 000, inclusive of taxes. JUDGMENT THIS COURT’S JUDGMENT IS that: 1. TransUnion breached the provisions of Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5, by: (

i) Collecting inaccurate personal financial information concerning the applicant; (ii) Transmitting inaccurate personal financial information concerning the applicant to third parties, including to the Royal Bank of Canada; (iii) Failing to promptly correct the inaccurate personal financial information concerning the applicant that it held in its database; and (iv) Failing to transmit the amended personal financial information concerning the applicant to third parties, including to the Royal Bank of Canada. 2. The respondent shall pay the applicant damages in the amount of $5 000; and 3.

The applicant is entitled to recover the disbursements in this application which are fixed at $1 000, inclusive of taxes. ANNEX A Personal Information Protection and Electronic Documents Act , S.C. 2000, c. 5 Purpose 3. The purpose of this

Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances. … Compliance with obligations 5.

(1) Subject to sections 6 to 9, every organization shall comply with the obligations set out in

Schedule 1. Meaning of “should”

(2) The word “should”, when used in

Schedule 1, indicates a recommendation and does not impose an obligation. Appropriate purposes

(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances. … Application 14.

(1) A complainant may, after receiving the Commissioner’s report, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of

Schedule 1, in clause 4.3, 4.5 or 4.9 of that

Schedule as modified or clarified by Division 1, in subsection 5(3) or 8(6) or (7) or in

section 10. Time of application

(2) The application must be made within forty-five days after the report … is sent or within any further time that the Court may, either before or after the expiry of those forty-five days, allow.

For greater certainty

(3) For greater certainty, subsections (1) and (2) apply in the same manner to complaints referred to in subsection 11(2) as to complaints referred to in subsection 11(1). … Remedies 16. The Court may, in addition to any other remedies it may give, (

a) order an organization to correct its practices in order to comply with sections 5 to 10; (

b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph ( a ); and (

c) award damages to the complainant, including damages for any humiliation that the complainant has suffered. …

SCHEDULE 1 … Principles Set Out In The National Standard of Canada Entitled Model Code for the Protection of Personal Information , CAN/CSA- Q830-96 4.6 … Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. … 4.6.3 Personal information that is used on an ongoing basis, including information that is disclosed to third parties, should generally be accurate and up-to-date, unless limits to the requirement for accuracy are clearly set out. ... 4.9.5 When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required.

Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question. [1] The relevant sections of PIPEDA and clauses of

Schedule 1 are reproduced in Annex A. The clauses in

Schedule 1 are referred to by the PCC and the parties using various terminology, including “principles”, “paragraphs”, and “subparagraphs”. For the sake of consistency all references to

Schedule I shall use the terms “clause” or “clauses”. [2] By order of the Court, all information concerning Mr. X has been sealed as confidential. [3] In reality it appears that TransUnion received no paper document as the information from CBV was transmitted electronically.