Mortgage Broker

CMB MAGAZINE cmba-achc.ca winter 2017 | 15 FULL DISCLOSURE? I was very interested in the letter from Linda Slader (Canadian Mortgage Broker, Fall 2016) about Equifax and its changes to the way it calculates credit scores. I have two questions: 1. Given the provisions of the Privacy Acts, I don't remember ever giving Equifax permission to store my information. What should one make of that? 2. Given the crucial role that the credit score plays in obtaining a mortgage, does Equifax not have a fiduciary duty to the people whose information it retains? Peter Dale Reply: You have specifically asked about Equifax; Transunion has roughly the same approach. I will refer to them together as credit- reporting agencies (CRAs). Your questions raise issues about privacy rights and the obligations of a CRA to individuals whose information is retained. Authority for a CRA to Collect, Use and Disclose Personal Information CRAs are limited by privacy legislation as to the collection, use and disclosure of personal information. e primary legislation at the federal level is the Personal Information Protection and Electronic Documents Act. Several provinces have enacted privacy legislation. As well, federal and provincial sector-specific legislation sometimes includes privacy protection provisions; for example, the federal Bank Act contains provisions regulating the use and disclosure of personal financial information by federally regulated financial institutions. By their very nature, credit reports and CRA files contain sensitive personal financial information, such as credit history, social insurance numbers, and lists of persons who have received a copy of an individual's credit report. is information is clearly protected by the privacy legislation. CRAs collect the personal information from reports provided to them by credit grantors and other institutions with whom the individual deals. Most oen, this information is provided to the CRA with the consent of the individual, the consent having been obtained as part of the loan- or credit-application process. Additionally, CRAs can, without the consent of the individual, collect information from sources permitted by law, such as from public records and from the individuals dealing directly with the CRA. In providing the consent, the individual specifies the purposes for which the information can be used and the disclosures that can be made. e obtained consent generally specifies that the information can be used for the purpose of credit reporting, and authorizes the credit grantor to disclose the information to CRAs. Privacy legislation recognizes the right of such use and disclosure where it is provided by the individual at the time the information was originally collected. CRA's Obligations to Individuals To protect the rights of consumers, most provinces have credit-reporting legislation outlining practices CRAs and users of credit information must adopt. ese can vary across provinces, but core requirements typically obligate CRAs to: ensure the accuracy of the information; limit disclosure of the information; and require CRAs to give consumers the right to have access to, and challenge the accuracy of, the information. Provincial credit-reporting legislation outlines purposes for which it is permissible for organizations to request information from a CRA; these purposes must relate to activities such as credit decisions, collection of debt, employment decisions, tenancy decisions, underwriting of insurance, determining a consumer's eligibility under a statute or regulation, or any decision where there is a direct business need for the information in connection with a credit or business transaction involving the consumer. It is an offence for anyone to obtain credit information from a credit-reporting agency except for the stated purposes. Credit-reporting legislation generally requires that users of credit information (such as financial institutions) advise the individual if the information obtained from a CRA is used to decline a benefit (such as denying an application for credit or employment) or if a charge to a consumer is increased. A credit grantor or other institution is required to carry out their function not only honestly, but accurately, with skill and diligence, and in accordance with statutory obligations. A credit grantor or other institution that makes a negligent report to a CRA can be held liable to debtors for damages [Haskett v. Equifax et al., [2003] 63 O.R. (3d) 577 Ont. C.A., para. 29]. For example, in Parmar v. Royal Bank of Canada, 2016 ABQB 439, the CRAs continued to show a balance owing under a mortgage even aer the debt had been resolved by negotiation. e individual claimed that the inaccurate reporting made it difficult for him to obtain credit, and sued the lender bank (including for the inaccurate reporting to the CRAs) and the CRAs (including for the inaccurate credit reports). e bank was liable for the damages caused to the individual for having provided inaccurate information to the CRA. e CRAs disputed their liability and the matter in relation to them was set for trial. (See "Accuracy Counts," Canadian Mortgage Broker, Fall 2016, for a fuller report of the Parmar case). Although the Parmar case focused on a breach of Alberta's Fair Trading Act, other provinces have similar legislative provisions. CRAs are not required to be perfect; they are, however, required to set up reasonable procedures for ensuring information is fair and accurate, and for investigating disputes [Spencer v. Equifax Canada Inc., 2011 ONSC 7284 (Ont. S.C.J.), paras 34, 35]. Summary Answers 1. Most credit applicants are likely to have consented to a CRA collecting, using and disclosing their information for purposes of creating and disclosing a credit report to future potential creditors. 2. CRAs do owe obligations to individuals – particularly to have reasonable procedures for ensuring that their information is fair and accurate, and for investigating disputes. Please send letters to the editor to info@cmba-achc.ca

• Cover