Consumer Reporting Act, consumer reporting agencies and users of consumer reports
In force.
A sensitive categories rule binding private bodies.
- Enforcement body
- Registrar of Consumer Reporting Agencies
- Obligation class
- Licensing, Consent, Disclosure, Data subject rights, Prohibition
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What it requires
- These duties bind a consumer reporting agency (a person who for gain or profit or on a regular co-operative non-profit basis furnishes consumer reports) and anyone who requests, obtains or acts on a consumer report, such as a lender, landlord, insurer or employer.
- Register with the Registrar before you conduct or act as a consumer reporting agency or act as a personal information investigator.
- As a consumer reporting agency, furnish information from your files only as section 8 allows: on a court order, on the consumer's written instructions, under an order or direction under the Act, or in a consumer report to a person you have reason to believe intends to use it for credit, a tenancy, employment, insurance underwriting, eligibility under a statute or regulation, a direct business need in a business or credit transaction, or updating a report.
- If you obtain information from a consumer reporting agency's files, do so only for a purpose section 8 allows.
- As a consumer reporting agency, adopt all procedures reasonable for ensuring accuracy and fairness in your consumer reports, report only information extracted from files stored or collected in a repository located in Canada, and leave out the items section 9 forbids, including race, creed, colour, sex, ancestry, ethnic origin and political affiliation and most adverse items more than seven years old.
- Before you request or obtain a consumer report containing personal information about a consumer, give the consumer written notice, and give the consumer the agency's name and address on request.
- If you deny a benefit or increase a charge wholly or partly because of information from a consumer reporting agency or another person, give the consumer notice when you communicate the action and, if the consumer asks within sixty days, say what the information was and where it came from or give the agency's name and address.
- As a consumer reporting agency, on a consumer's written request disclose the consumer's file, sources, recipients and, if asked, current consumer score; correct, supplement or delete disputed information in accordance with good practice and notify the persons the corrected report went to.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Subsection 23 (1) makes contravening any provision of the Act or the regulations an offence, with a fine of not more than $50,000 or imprisonment for not more than one year, or both, and subsection 23 (2) caps the penalty on a convicted corporation at $250,000.
Penalty structure
Subsection 23 (2) caps the penalty on a convicted corporation at $250,000. For any other person subsection 23 (1) sets a fine of not more than $50,000 or imprisonment for not more than one year, or both.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 250,000
What this law does
A consumer reporting agency is a person who for gain or profit or on a regular co-operative non-profit basis furnishes consumer reports, and a consumer report is a communication by such an agency of credit information or personal information, or both, pertaining to a consumer for consideration in connection with a purpose set out in clause 8 (1) (d).
No person may conduct or act as a consumer reporting agency, or act as a personal information investigator, unless registered by the Registrar under the Act.
A consumer reporting agency may knowingly furnish information from its files only in response to a court order, on the written instructions of the consumer, in response to an order or direction under the Act, or in a consumer report given to a person it has reason to believe intends to use the information for credit, a tenancy, employment purposes, insurance underwriting, eligibility under a statute or regulation, a direct business need in connection with a business or credit transaction, or updating a report previously given.
No person may knowingly obtain information from the files of a consumer reporting agency respecting a consumer except for those purposes. A consumer reporting agency must adopt all procedures reasonable for ensuring accuracy and fairness in the contents of its consumer reports.
A consumer reporting agency must not report information that is not extracted from information appearing in files stored or collected in a repository located in Canada, whether or not the information was obtained from a source outside Canada, except that a written report may contain the substance of prior information orally acquired that conforms to the Act.
A consumer report must not include information as to race, creed, colour, sex, ancestry, ethnic origin or political affiliation, or any other adverse item of information more than seven years after it was acquired or last reaffirmed. A person must give a consumer written notice before requesting or obtaining a consumer report containing personal information about the consumer.
Where a benefit is denied to a consumer or a charge to a consumer is increased wholly or partly because of information received from a consumer reporting agency or another person, the user of the information must deliver notice of that fact to the consumer when the action is communicated. A consumer may in writing request a consumer reporting agency to provide the consumer's consumer report, or the consumer's current consumer score and consumer report.
A consumer may dispute the accuracy or completeness of an item of information in the consumer's file, and the agency must use its best endeavours to confirm or complete the information and correct, supplement or delete it in accordance with good practice. The security freeze provisions, under which a prescribed consumer reporting agency places, suspends and terminates a security freeze on a consumer's file, have been in force since .
A person convicted of an offence under the Act is liable to a fine of not more than $50,000 or to imprisonment for not more than one year, or to both, and a corporation convicted is liable to a fine of not more than $250,000. A person who contravenes the Act or the regulations is liable to a consumer for any damages sustained by the consumer as a result of the contravention, and the consumer may commence an action in the Superior Court of Justice.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or provides financial services.