Canadian privacy & access decisions

An individual complained that a bank performed numerous credit checks on her without consent, despite her not being a client for many years. The bank initially claimed the inquiries were from its marketing group and not visible to other organizations, but its internal investigation revealed they were 'soft hits' related to inactive accounts from 2013. The bank's privacy policy stated it retained the ability to perform credit inquiries after a service ended, but the OPC expressed concern over the continued collection of sensitive credit information without a legal requirement. To resolve the complaint, the bank agreed to cease this practice and update its privacy policy. The complainant was satisfied, and the matter was early resolved.

• Whether a bank can continue to perform credit checks on former clients without their consent
• Whether the bank's privacy policy adequately justified continued credit inquiries after the termination of a business relationship
• Whether the bank provided accurate information to the complainant regarding the source and nature of the credit inquiries