Can Someone Pull Your Credit Report Without Consent?

Last updated on December 1, 2021

Rob sends us a question after a subscription provider seemingly pulled his credit report with no consent.

Question

I had subscribed for [Subscription Service] and a few months after I found out that they obtained my credit report without my consent or knowledge.

I have escalated this issue (and unsubscribed their service due to this concern) and [Provider] said I provided them implied consent by choosing to do business with them.

PIPEDA outlines that Consent must be obtained prior to collecting, using and sharing personal information and a person should be aware what one is consenting to.

My questions to you are:

1. Did [Provider] violate my privacy right under PIPEDA and/Privacy Act?
2. I live in Nova Scotia. Did they also possibly violate Provincial privacy laws by failing to obtain consent and notifying me about my Credit Check?
3. What legal recourse do I have against [Provider]?

Thank you.

—Rob

Answer

Hi Rob,

One of the different types of consent an organization can obtain under PIPEDA or provincial privacy laws is implied consent — consent that can be reasonably inferred from an action.

Performing a credit check, however, usually cannot be done under implied consent. Credit bureaus will only allow member companies to perform credit checks on their applicants with express, written consent.

Rob, I have a hunch that two things have happened:

1. Whoever you spoke with on the phone may have not fully understood how your consent was obtained to perform a credit check and instead told you erroneous information.
2. An organization the size you are dealing with will likely have obtained your written consent somewhere throughout the contracts you signed.

My suggestion to you is to get the contact information of the individual or team responsible for privacy compliance and send your concern in an email or letter. You will likely receive a response back with the section of the contract you signed that permitted a credit check.

If the official response is that your credit was pulled with implied consent by way of doing business with that organization, submit a complaint to the Office of the Privacy Commissioner of Canada under PIPEDA. This is your legal recourse.

There is no specific private sector privacy legislation in Nova Scotia and as such, PIPEDA will apply to your scenario.

All the best,
—M.G.