PIPEDA Findings #2021-006: A short-term lender collects online banking credentials in the course of payday loan applications
The OPC initiated an investigation into CashHere, a short-term lender, after being alerted by the Ontario Ministry of Government and Consumer Services that it was collecting online banking credentials (passwords, usernames, security questions/answers) from loan applicants. The OPC found that while CashHere had a legitimate need to validate identity and income, collecting banking credentials was not an appropriate purpose under PIPEDA s. 5(3) due to less privacy-invasive alternatives and disproportionate privacy risks. The investigation also noted that a related entity, MoneyHome, appeared to be continuing the same practices. CashHere ceased responding to the OPC, and the matter was found to be well-founded and unresolved.
- 1Whether CashHere's collection of online banking login credentials was for a purpose that a reasonable person would consider appropriate under s. 5(3) of PIPEDA
- 2Whether the collection of banking credentials was effective in meeting CashHere's legitimate need
- 3Whether there were less privacy-invasive means of achieving the same ends
- 4Whether the loss of privacy was proportional to the benefits for CashHere
- Collection of banking credentials: Not an appropriate purpose under PIPEDA s. 5(3)
- Availability of alternatives: Less privacy-invasive alternatives existed
- Privacy risks: Collection posed disproportionate privacy risks
- Related entity practices: Related entity appeared to continue same practices
- Investigation outcome: Complaint well-founded and unresolved
Complaint well-founded and unresolved
The OPC found that collecting highly sensitive banking login credentials was not an appropriate purpose under PIPEDA s. 5(3) because less privacy-invasive alternatives existed, and the privacy risks to individuals were disproportionate to the commercial benefits for the lender. CashHere ceased cooperation, and a related entity continued the practice, leaving the contravention unresolved.
The OPC intended to share its findings with MoneyHome and publish the report to inform MoneyHome and other payday loan organizations that collecting banking login credentials is a contravention of PIPEDA and should cease.
- s. 5(3) PIPEDA
- Principle 4.4 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro