Bill 75 2008

An Act to amend the Consumer Reporting Act

Note: This Act amends the Consumer Reporting Act.  For the legislative history of the Act, see the Table of Consolidated Public Statutes – Detailed Legislative History on www.e-Laws.gov.on.ca.

Her Majesty, by and with the advice and consent of the Legislative Assembly of the Province of Ontario, enacts as follows:

   1.  (1)  The definition of "consumer report" in subsection 1 (1) of the Consumer Reporting Act is amended by striking out "written, oral or other communication" and substituting "written or other communication, except an oral communication". 

   (2)  The definition of "credit information" in subsection 1 (1) of the Act is amended by adding at the end "as well as unique identifier numbers and inquiry records arising out of applications for credit only".

   (3)  Subsection 1 (1) of the Act is amended by adding the following definitions:

"credit score" means a numerical value or categorization derived from a statistical tool or modelling system used by a consumer reporting agency to predict the likelihood of certain credit behaviours, including default; ("cote de crédit")

"inquiry record" means a record indicating that a credit inquiry has been received with respect to a consumer and that, pursuant to that inquiry, personal or credit information relating to the consumer has been provided; ("dossier de demande de renseignements")   

"key factors" means all relevant elements or reasons adversely affecting the credit score for a particular individual listed in order of their importance based on their effect on the credit score; ("éléments-clés")

   (4)  The definition of "personal information" in subsection 1 (1) of the Act is amended by striking out "or about any other matter concerning the consumer" at the end.

   (5)  Subsection 1 (1) of the Act is amended by adding the following definition:

"unique identifier number" means a number assigned to a consumer credit information file by a consumer reporting agency as a means of identifying the consumer. ("numéro identificateur unique")

   2.  (1)  Clause 8 (1) (d) of the Act is amended by striking out the portion before subclause (i) and substituting the following:

  (d)  in a consumer report given only to a person who obtained the consumer's written instructions under clause (1) (b) and who it has reason to believe,

.     .     .     .     .

   (2)  Section 8 of the Act is amended by adding the following subsection:

Same

   (1.1)  No consumer reporting agency shall provide a consumer report to any person without first obtaining,

  (a)  a copy of the consent by which the consumer authorized the communication of personal or credit information;

  (b)  the person's name, address, telephone and fax numbers and the reference number under which the person stored the original of the consumer's consent to the communication of personal or credit information to the person; and

   (c)  confirmation that the information is sought for a purpose permitted under this section and will be used for no other purpose.

   (3)  Subsection 8 (3) of the Act is amended by striking out "Despite subsections (1) and (2)" at the beginning and substituting "Despite subsections (1), (1.1) and (2)".

   3.  (1)  Subsection 9 (1) of the Act is repealed and the following substituted:

Procedures of agencies

   (1)  Every consumer reporting agency shall ensure accuracy and fairness in its consumer reports.

   (2)  Subsection 9 (2) of the Act is amended by adding the following clauses:

   (c)  information pertaining to a consumer's address, date of birth, social insurance number and credit account numbers that is not provided in a truncated form, except where a court of competent jurisdiction issues an order for the inclusion of such information;

  (d)  any information that is not provided by the person providing the information, except for the unique identifier number;

  (e)  any information pertaining to inquiry records that has not been obtained as a result of a direct application for credit or an application for an increase in credit.  

   (3)  Clause 9 (3) (a) of the Act is repealed and the following substituted:

  (a)  any credit information based on evidence that is not able to be corroborated by the consumer's instructions under clause 8 (1) (b) and a written agreement between the consumer and the person providing the goods or services to the consumer;  

   (4)  Subsection 9 (3) of the Act is amended by adding the following clauses:  

(e.1) information as to the creditors of the consumer in a bankruptcy proceeding and the amounts owing by the consumer at the date of the consumer's discharge from bankruptcy;

(e.2) information that is in oral form;

.     .     .     .     .

(j.1)  information as to an inquiry record after three years following the date of the consumer's application for credit that gave rise to the inquiry record;

   (5)  Section 9 of the Act is amended by adding the following subsections:

Calculation of credit scores

   (3.1)  No consumer reporting agency shall consider as a key factor in determining the credit score of a person the fact that there is an inquiry record or that personal or credit information has been obtained.

Duty to include information not at issue

   (3.2)  Where a consumer has commenced a legal proceeding against a consumer reporting agency, the agency shall not delete or otherwise fail to include personal or credit information in a consumer report as long as that information is not at issue in the legal proceeding.

.     .     .     .     .

Collection, storage and disclosure of information in files

   (5)  For the purpose of ensuring accuracy and fairness as described in subsection (1) and, in addition, for the purpose of ensuring privacy, integrity and confidentiality with respect to the information in its reports, every consumer reporting agency shall adopt all procedures that are reasonable, including,

  (a)  ensuring that all information is collected, stored and disclosed in accordance with this Act and the principles of fair information practices listed in Schedule 1 to the Personal Information Protection and Electronic Documents Act (Canada);

  (b)  ensuring that all retention, disclosure and use of personal or credit information and personally identifiable data by the consumer reporting agency has the consumer's explicit consent, as witnessed by the consumer's written signature;

   (c)  ensuring that electronic signature certificates originate from a certification authority approved by the federal Communications Security Establishment with a registered object identifier number issued by Public Works and Government Services Canada and that,

           (i)  all personal or credit information is adequately secured with encryption mechanisms to prevent inadvertent disclosure,

          (ii)  notification is provided to the consumer before the deletion of any personal or credit information in accordance with the requirements of the Personal Information Protection and Electronic Documents Act (Canada),

         (iii)  access is provided to the Registrar and other authorized persons for the purpose of auditing and reporting on compliance with requirements for the retention, disclosure and use of personal or credit information, personally identifiable data and collected consents, and

         (iv)  the consumer reporting agency complies with its responsibilities regarding the retention, disclosure and use of personal or credit information, personally identifiable data and collected consents.

Definitions

   (6)  In this section,

"electronic document" means data that is recorded or stored on any medium in or by a computer system or other similar device and that can be read or perceived by a person or a computer system or other similar device, and includes a display, printout or other output of that data; ("document électronique")

"electronic signature" means a signature that consists of one or more letters, characters, numbers or other symbols in digital form incorporated in, attached to or associated with an electronic document; ("signature électronique")

"personally identifiable data" means any data relating to an identified or identifiable individual who is the subject of the data. ("données personnelles identifiables") 

   4.  (1)  Subsection 10 (1) of the Act is repealed and the following substituted:

Disclosure of report

   (1)  Every person who refers to a consumer report in connection with any specified transaction or matter in which the person is engaged shall,

  (a)  inform the consumer that a consumer report respecting him or her has been or is to be referred to;

  (b)  provide the consumer with the name and address of the consumer reporting agency supplying the report; and

   (c)  upon the consumer's request, provide the consumer with a copy of the consumer report, by mail or personal delivery, within 30 days of obtaining the report.

   (2)  Subsection 10 (2) of the Act is amended by striking out "where the consumer so requests" in the portion after clause (b).

   (3)  Subsection 10 (3) of the Act is repealed and the following substituted:

Same

   (3)  If a person proposes to extend credit to a consumer and a consumer report containing only credit information is being or may be referred to in connection with the transaction, the person shall give notice of the fact to the consumer in writing at the time of the application for credit and provide the name and address of the consumer reporting agency that will be supplying the report.

   (4)  Subsection 10 (5) of the Act is amended by striking out "unless the person notifies the consumer in writing at the time of the application for credit that the person intends to do so" at the end.

   (5)  Subsection 10 (7) of the Act is repealed and the following substituted:

Adverse action

   (7)  If a benefit is denied to a consumer or a charge to a consumer is increased either wholly or partly because of information received from a consumer reporting agency or a person other than a consumer reporting agency, the user of the information shall communicate the action to the consumer and at the time the action is communicated,

  (a)  inform the consumer of the nature and source of the information, if it is furnished by a person other than a consumer reporting agency; or

  (b)  deliver to the consumer a copy of the consumer report, including the name and address of the consumer reporting agency, if the information is furnished by a consumer reporting agency.

Same

   (8)  The notice required under subsection (7) shall include notice of the consumer's right to correct any errors in the information received from a consumer reporting agency or a person other than a consumer reporting agency.

   5.  (1)  Subsection 11 (1) of the Act is repealed and the following substituted:

Supplying list of names

   (1)  No person shall supply a list of names and criteria to a consumer reporting agency in order to obtain an indication of the names of the persons named in the list who meet the criteria unless,

  (a)  the person first notifies in writing each person named on the list or about whom information is being obtained that such a list is being submitted or that information is being requested; and

  (b)  the person provides the name and address of the consumer reporting agency involved.

   (2)  Subsection 11 (4) of the Act is repealed and the following substituted:

Supplying list of criteria

   (4)  No consumer reporting agency that receives a list of names and criteria, or receives a request for names of persons so that information may be inferred about them, shall provide the name of any person without first notifying that person in writing of the request and the name and address of the person making the request and obtaining consent to the request.

   6.  (1)  Clause 12 (1) (c) of the Act is repealed and the following substituted:

   (c)  the name, address and telephone number of every person on whose behalf the file has been accessed within the three-year period preceding the request;

   (2)  Clause 12 (1) (d) of the Act is amended by adding "addresses and telephone numbers" after "the names" in the portion before subclause (i).

   (3)  Clause 12 (1) (e) of the Act is repealed and the following substituted:

  (e)  copies of any written or electronically transmitted consumer report pertaining to the consumer made to any other person, furnished,

           (i)  where the report contains personal information, within the one-year period preceding the request, and

          (ii)  where the report contains credit information, within the six-month period preceding the request,

   (4)  Subsection 12 (1) of the Act is amended by adding the following clause:

    (f)  the current credit score or the most recent credit score that was previously calculated by the consumer reporting agency, including,

           (i)  the range of possible credit scores under the model used,

          (ii)  all the key factors that adversely affected the score,

         (iii)  the date the credit score was created, and

         (iv)  a summary of how the credit score was calculated, including the method used,

   (5)  Subsection 12 (2) of the Act is repealed.

   (6)  Clause 12 (3) (b) of the Act is repealed and the following substituted:

  (b)  by mail if he or she has made a written request.

   (7)  Subsection 12 (4) of the Act is repealed and the following substituted:

Same

   (4)  Every consumer reporting agency shall provide a toll free telephone number and trained personnel to explain to the consumer any information furnished to him or her under this section.

   (8)  Subsection 12 (5) of the Act is repealed and the following substituted:

Consumer's adviser

   (5)  A consumer who makes a request for disclosure under clause (3) (a) shall be permitted to be accompanied by one or more persons of his or her choosing to whom the consumer reporting agency may be required by the consumer to disclose his or her file.

   7.  The Act is amended by adding the following section:

Duty to inform consumer of unlawful disclosure

   12.4  (1)  Every consumer reporting agency shall, immediately on discovering that any of a consumer's information has been unlawfully disclosed, lost or stolen, disclose such discovery to the consumer. 

Same, person to whom consumer report provided

   (2)  Every person supplied with a consumer report by a consumer reporting agency shall, immediately on discovering that any of the consumer's information has been unlawfully disclosed, lost or stolen while the information was in the possession or under the control of the person, disclose such discovery to the consumer.

   8.  (1)  Subsection 13 (1) of the Act is repealed and the following substituted:

Correction of errors

   (1)  If a consumer disputes the accuracy or completeness of any item of information contained in his or her file, the consumer reporting agency shall, within 30 days, investigate the dispute and notify the consumer in writing of the results of the investigation.

Same

   (1.1)  If an investigation under subsection (1) results in a determination that the disputed information is unconfirmed, inaccurate or incomplete, the consumer reporting agency shall,

  (a)  within 30 days after receiving the notice of dispute by the consumer, delete disputed information that is unconfirmed; and

  (b)  correct or supplement disputed information that is inaccurate or incomplete in accordance with good practice.

Same

   (1.2)  If, after an investigation under subsection (1) and action under subsection (1.1), a consumer still disputes the accuracy or completeness of the disputed information or disputes the correction or supplement under subsection (1.1), the consumer reporting agency shall include in all consumer reports respecting the consumer a statement outlining the nature and basis of the dispute.

   (2)  Subsection 13 (2) of the Act is amended by striking out the portion before clause (a) and substituting the following:

Same

   (2)  If a consumer reporting agency deletes, corrects or supplements information under subsection (1.1) or adds a statement of dispute under subsection (1.2), the consumer reporting agency shall furnish notification of the correction, supplement, deletion or addition to the consumer and to,

.     .     .     .     .

Commencement

   9.  This Act comes into force six months after the day it receives Royal Assent.

Short title

   10.  The short title of this Act is the Consumer Reporting Amendment Act, 2008.

 

EXPLANATORY NOTE

Duty to inform about missing or stolen information

The Bill provides that where a consumer reporting agency and any other person, such as a bank, to whom a consumer report has been provided, discover that there has been an unlawful disclosure of consumer information or that such information has been lost or stolen, they shall immediately inform the affected consumer. (Subsections 12.4 (1) and (2) of the Act)

Duty to truncate vital information

The Bill provides that a consumer report shall not provide information pertaining to a consumer's address, date of birth, social insurance number and credit account number that is not in a truncated form and also that there be no information in a consumer report other than information provided by the information provider, except for the unique identifier number. (Clauses 9 (2) (c) and (d) of the Act)    

Duty to delete unconfirmed information within 30 days

The Bill provides that consumer reporting agencies shall investigate disputed information within 30 days and correct, supplement or delete any information found to be unconfirmed, incomplete or inaccurate. (Subsection 13 (1.1) of the Act)

Duty not to penalize consumers for applying for credit

The Bill provides that consumer reporting agencies and other persons may not consider, as a key factor in determining the credit score of a consumer, the fact that a consumer report has been requested. In addition, credit scores and the key factors used to determine them are added to the list of information to be disclosed to a consumer on request. (Subsection 9 (3.1) of the Act)

Duty to provide full disclosure if credit denied  

The Bill provides that a person who takes adverse action against a consumer on the basis of information contained in a consumer report shall inform the consumer of the action and provide a copy of the report, including the name and address of the agency that prepared it, and shall notify the consumer of the right to correct incomplete or inaccurate information. (Subsections 10 (7) and 12 (1) of the Act) 

Duty to record only inquiries resulting from applications for credit

The Bill provides that consumer reporting agencies shall only report inquiry records resulting out of actual applications for credit except in a report given to the consumer. (Clause 9 (2) (e) of the Act)

Duty to report in writing only

The Bill provides that consumer reporting agencies shall only report information on consumer reports in written or electronically transmitted form, and not orally. (Clauses 9 (3) (e.2) and 12 (1) (e) of the Act)

Duty to retain information that is not contested legally 

The Bill provides that consumer reporting agencies shall not delete or otherwise fail to make available any information in a consumer file that is not contested in legal proceedings brought by a consumer against the agency arising out of a claim of inaccuracy in a consumer report. (Subsection 9 (3.2) of the Act)

Duty not to report debts vacated after bankruptcy proceedings

The Bill provides that consumer reporting agencies shall not provide the names of creditors or the amounts owing to such creditors after the date on which the debtor is discharged from bankruptcy. The consumer reporting agencies shall continue to be able to note bankruptcies by providing information on the date of filing for bankruptcy, the date of the discharge and the total amount involved. (Clause 9 (3) (e.1) of the Act)

Duty to provide a true copy of report

The Bill provides that consumers are entitled to a true copy of the report obtained by a third party upon request so as to be able to challenge its accuracy. (Clause 10 (7) (b) of the Act)

Duty to store and safeguard information in accordance with the Personal Information Protection and Electronic Documents Act (Canada)

The Bill incorporates guidelines for storing and safekeeping of consumer information, including electronic signatures, under the Personal Information Protection and Electronic Documents Act (Canada), for the purpose of minimizing identity theft. (Clauses 9 (5) (a), (b) and (c) of the Act)