Privacy Commissioner
Commissaire a la protection of Canada de la vie privee du Canada
112, rue Kent
Ottawa (Ontario)
K1A1H3
Tel.: (613) 995-8210
Telec: (613) 947-6850
1-800-282-1376
www.privcom.gc.ca
File: 6100-0081
Ms Philippa Lawson
Public Interest Advocacy Centre One Nicholas Street, Suite 1204 Ottawa, ON K1N7B7
Dear Ms Lawson:
This letter constitutes my report of findings with regard to the complaint you filed against Bell Canada (Bell) under the Personal Information Protection and Electronic Documents Act (the Act}. In your complaint received in my Office on October 18, 2001, you made reference to Principle 4.3 (Consent) of Schedule 1 to the Act and alleged that Bell was not obtaining informed consent from individuals for the collection, use, or disclosure of personal information for secondary marketing purposes.
Specifically, you alleged that Bell was not bringing to the attention of its residential local telephone customers (a) its policy of sharing customer data with affiliates for secondary marketing purposes and (b) the corresponding opportunity for customers to opt-out of such sharing.
I have determined, first of all, that the subject matter of your complaint does fall within my jurisdiction under the Act. As of January 1, 2001, the Act applies to any federal work, undertaking, or business. By operation of constitutional law, any telecommunications company, such as Bell, is a federal work, undertaking, or business. On this basis, therefore, I was required under section 12 of the Act to accept and investigate your complaint.
Some weeks after filing your original complaint, you specified to my Office that you had intended your complaint against Bell to apply to the information practices of the affiliates as well. You may have assumed that Bell’s affiliates formed part of the Bell corporate entity. Bell’s affiliates are in fact separate corporate entities; moreover, only three of them are federal works, undertakings, or businesses subject to the Act. A separate complaint file has been opened for each of these three Bell affiliates that fall under my jurisdiction, and I will issue separate letters of findings for each in due course.
I have also determined from the facts of the case that the information at issue is personal information for purposes of the Act. Section 2 of the Act defines personal information to be ”…information about an identifiable individual…”. It is clear from the wording of your complaint that your concern is information about Bell’s customers as identifiable individuals.
Before I provide you with my other findings, let me first outline the facts obtained in the course of my Office’s investigation.
You have filed similar complaints against several organizations, one of which is Bell. For all of these complaints, you have formulated a general position, in support of which you have submitted a market research survey conducted by EKOS Research Associates Inc. I summarize your position as follows:
- It is always appropriate to ensure the individual’s knowledge and consent in respect of secondary marketing purposes.
- There is a clear difference, however, between marketers and the marketed on the issue of what form of consent is appropriate – that is, express consent versus implied consent.
- Companies often appear to take the view that a customer’s consent to secondary marketing can be taken as implied provided that the policy in question is stated in some document that is accessible to the customer. However, companies have an obligation not merely to state purposes in a policy document, but also to bring to the attention of the individual customer the practices in question and the negative option attached.
- Companies commonly fall short of meeting this obligation in several ways:
- reliance on a document not provided to the individual customer, but rather left up to the customer to find on his or her own initiative;
- reliance on fine print buried in a long document;
- failure to use clear, plain language understandable to the ordinary consumer;
- failure to provide customers with adequately detailed information about the extent and purpose of contemplated uses and sharing of their personal information; and
- failure to provide an easily executable opting-out procedure.
- The EKOS marketing survey shows a preference for opt-in versus opt-out consent among a clear majority of respondents. Opt-out consent is considered acceptable only under conditions where the opting-out provision is brought to the customer’s attention, is clearly worded and sufficiently detailed, and is easy to execute.
In 1986, the Canadian Radio-television and Telecommunications Commission (CRTC) imposed a restriction on Bell’s disclosure of customers’ personal information. This restriction appears as follows in Article 11 (“Confidentiality of Customer Records”) of the Bell Canada Terms of Service:
11.1 Unless a customer consents in writing or disclosure is pursuant to a legal power, all information kept by Bell Canada regarding the customer, other than the customer’s name, address and LISTED TELEPHONE number, are confidential and may not be disclosed by Bell Canada to anyone other than:
- the customer;
- a person who, in the reasonable judgement of Bell Canada, is seeking the information as an agent of the customer;
- another telephone company, provided the information is required for the efficient and cost-effective provision of telephone service and disclosure is made on a confidential basis with the information to be used only for that purpose;
- a company involved in supplying the customer with telephone or telephone directory related services, provided the information is required for that purpose and disclosure is made on a confidential basis with the information to be used only for that purpose; or
- an agent retained by Bell Canada in the collection of the customer’s account, provided the information is required for and is to be used only for that purpose.
Thus, with the very limited exceptions noted, Bell is prohibited by the CRTC from disclosing customers’ information, other than publicly available information (i.e., names, addresses, and telephone numbers already listed in directories), to anyone, including its affiliates, without the express written consent of the individual customer.
My Office’s investigation has confirmed that Bell does not make a practice of disclosing customer information to its affiliates and does not have express written consent for such disclosure from most of its residential and business customers. Bell has explained that, because the process of obtaining express written consent would be cumbersome, the company some time ago made the decision not to seek such consent from customers, but rather to forego such disclosure of information in general.
One notable exception is a form that customers are asked to fill out in Bell stores, authorizing Bell Canada/ Bell Mobility to share, with the store representative, customers’ information relating to the products and services. Another exception was a direct mail-out to approximately 100,000 customers in the year 2000, seeking written consent for disclosure of customer information to all the Bell companies. I note that both of these exceptions comply with Article 11 in that they seek express written consent from the individual customer. Bell affirms, furthermore, that it has never relied upon any consent obtained from the mail-out; in other words, no information has actually been disclosed on the basis of any response from this initiative. Bell has also pointed out that it has never disclosed customer information to companies other than its affiliates, even though Article 11 would permit such third-party disclosures, too, provided that customers’ express written consent was obtained.
Despite having abided by Article 11 since its inception, in November 2000 Bell (along with many other telecommunications companies likewise subject to it) applied to the CRTC to have this restriction modified so as to permit disclosure of confidential customer information to affiliates without having to obtain written consent from the customer. Bell for one believes that Article 11 is unduly more stringent than the Act, which allows for implied consent in some circumstances. You yourself have made a submission to the CRTC, to the effect that Article 11 should remain unchanged. The CRTC has not yet issued a decision in this matter.
On the basis of these facts, I am required to determine whether Bell is in compliance with Principle 4.3 of Schedule 1 to the Act as far as the disclosure of customers’ personal information to its affiliates is concerned. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
On the evidence, I am satisfied that Bell does not make a practice of disclosing customers’ personal information to its affiliates. I am also satisfied that, in the exceptional circumstances where the company has contemplated such disclosure, it has duly informed the individual customer of its intention and has endeavoured to obtain the individual’s express written consent as required by the CRTC. I therefore have no grounds upon which to find that Bell has contravened Principle 4.3 of Schedule 1 to the Act.
Accordingly, I conclude that your complaint against Bell is not well-founded.
Whatever the outcome of its application regarding Article 11,1 trust that Bell will continue to meet all its obligations under the Act, taking due account of the entirely reasonable expectations about consent that you have articulated in your complaint.
Now that you have my report, I must inform you that, pursuant to section 14 of the Act, you have the legal right to apply to the Federal Court, Trial Division, for a hearing in respect of any matter that you complained about or that I have dealt with in my report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of the Schedule as modified or clarified by the Act, in subsection 5(3), or 8(6) or (7) or in section 10.
Should you wish to proceed to the Court, we suggest you contact the Trial Division of the Court office nearest you. It is located at the Supreme Court Building, Kent & Wellington, Ottawa, ON K1A OH9, telephone (613) 992-4238. Normally, an application must be made within 45 days of the date of this letter.
You should also be aware that the Court has discretion to order that the costs of the other party be paid by you where the Court is of the view that this is appropriate. While this does not happen often, it is a possibility of which you should be aware. Conversely, the Court may order that your costs be paid where the Court finds that your application raises an important new principle.
This concludes the investigation of your complaint. If you have any questions or comments about the disposition of the complaint, I would invite you to contact Mr. Gerald Neary, Director General of Investigations, at 1-800-282-1376.
George Kauwanski Privacy Commissioner of Canada