David Stonehouse News

Opening the vault on you

A new law gives you the right to see what secrets your bank has collected about you

By David Stonehouse

Ever wonder what secrets your bank knows about you?

Now you can find out.

A little-used federal law empowers you with the right to demand banks disclose the personal information they have been keeping on you.

Thanks to something called the Personal Information and Protection of Electronic Documents Act, all you need do is write your bank and ask for it.

"You could tailor your access request. You could say you want 'the information pertaining to my recent loan application.' Or you could say, 'I want all the information you have on me,' " says Murray Long, a privacy consultant in Ottawa. "They have to provide it to you, and they have to provide an explanation of what it means."

The new law, which came into force last year, gives banks 30 days to respond to the request and mandates that they provide the information for free or at a minimal cost.

"What you get back could be copies of everything that it is in your file. In theory, that includes all correspondence you have had with the bank and any information that contains opinions and judgments that have been made by the bank about you as a customer. All of that information is your personal information," says Mr. Long, an expert on the act and co-author of the Canadian Privacy Law Handbook.

By 2004, you will be able to use the law to get access to personal data that any company in Canada keeps on you. For now, only federally regulated companies such as banks, telephone companies and airlines have to comply with the law.

Credit unions and other financial institutions do not have to comply until Jan. 1, 2004, but might already have policies in place to respond to your request.

Chances are, most of the information a bank keeps on you won't be anything surprising. It will be data you have given them, such as your address and social insurance number. There will be account numbers and maybe some bank memos about the times that you phoned in to inquire about something.

All pretty straightforward stuff. So why would you bother?

"The premise behind the principle is that the individual can look at the information and make sure it is accurate, complete and up to date," says Jane Dargie, a privacy expert with Deloitte & Touche in Toronto. "You can imagine, for example, if you are dealing with a bank and you apply for credit and you are turned down. You would want to check to make sure they had the right information in order to make that determination."

The file might reveal clues to why the loans officer didn't approve your loan application and will likely include a summary from a credit reporting agency revealing any time you missed a mortgage payment, skipped out on a credit card bill or went into arrears with the hydro company.

You have always been able to request those credit histories from the reporting agencies, but many people never bother. It is important to do, though, just in case there is a mistake in there that someday comes back to haunt you.

The new law also requires institutions to have safeguards in place to prevent your personal information from being improperly disclosed and sets out conditions for when they must obtain your consent before revealing it to others, even affiliate firms.

But getting back to finding out what they know about you: Experts in the law say it allows you not only to get your bank files, but also files from credit bureaus and on credit card accounts offered by banks.

This might not seem significant because information from credit reporting agencies and credit card companies has always been there pretty much just for the asking. But formally requesting the information under the Personal Information and Protection of Electronic Documents Act allows you this advantage: If you don't get want you are after or are unhappy with the response, you can complain to the federal Privacy Commissioner George Radwanski, whose office is obliged to investigate.

Mr. Radwanski declined a request to be interviewed for this story, but anybody can get a sense of his dealings with the law by visiting his Web site. His rulings are made public and posted online, although the identities of institutions involved and the names of people who complained are not revealed.

The biggest test of the access provision of the law so far involved a woman who complained that her bank was refusing to divulge the credit score it assigned her. At first, Mr. Radwanski declared that that information should be disclosed, telling a reporter that a person should have a right to the ranking because it was personal information that the bank uses to make judgments about you.

Then earlier this year, he reversed himself and reluctantly agreed with the bank's argument that its competitors might be able to crack its scoring formula if it were forced to release the information. The act allows banks to witRating 2 old commercially sensitive information in files.

This means that banks are now allowed to witRating 2 old rankings they calculated themselves, although scores that the bank receives from others such as a credit bureau should still be made available.

In another case, the commissioner admonished a bank for being 74 days late in responding to an access request and for refusing to translate terminology used in a credit bureau report.

There have been few other rulings in access cases so far, which leads experts to suspect that not many people are using the law to obtain their files.

Arthur Cockfield, a law professor at Queen's University who has followed the commissioner's rulings, predicts that the handful of complaints are probably "just the tip of the iceberg" and will grow once people are aware of their new rights under the law.

"This is something that all Canadians -- or all Canadians with bank accounts -- should at least be aware of. Presumably, one would have seen a flood of these requests. But I am not aware of that at all," he says."Certainly a fear that banks have is that millions of Canadians will write those letters and bog down their administration with these requests." The Canadian Bankers Association says it does not keep statistics on the number of requests its members are getting for client files. It says most of the information banks have is what the clients themselves divulge but suggest people wanting their files talk to their bank first.

"The best place to start is to speak to your own bank about what the process is and what the privacy policies are," says Denise Harrington, the association's vice-president of public affairs. "They are very willing to help guide customers through this issue and assist in the best way they can."

Uncovering Your Secrets
If you want to find out what personal information your bank or a credit bureau has on you:

- Write a letter to your bank branch or to the credit bureau telling it what you are looking for and that you are seeking the information under the Personal Information and Protection of Electronic Documents Act.

It is a good idea to be specific about the information you are seeking, though you are also entitled to ask for everything that pertains to you.

- Under the act, it has 30 days to respond to your request. It is required to provide you with the information for free or at a "minimal cost."

- If you have a complaint after getting the information, talk to officials at the bank or credit bureau about it. If you are still not satisfied, you can lodge a complaint by writing to the Privacy Commissioner at 112 Kent St., Ottawa, ON K1A 1H3.

- For more information on this law and your rights under it, you can go to the Privacy Commissioner's Web site at www.privcom.gc.ca or call his office at (613) 995-8210 or, toll-free, 1-800-282-1376.

- For information on the privacy and disclosure policies of banks, visit your bank or its Web site or browse the Canadian Bankers Association site at www.cba.ca.

You can get more detailed information about obtaining your files by phoning these credit bureaus or by going to their Web sites:

- Equifax: www.equifax.ca, 1-800-465-7166

- Trans Union of Canada, www.tuc.ca, 1-800-663-9980 in all provinces
except Quebec, or 1-877-713-3393 in Quebec.