The law gives individuals the right to know why an organization collects, uses or discloses their personal information. It expects an organization to be reasonable and appropriate in its use and dissemination of an individual's personal information and not use the information for any purpose other than that to which they have consented.2 PIPEDA requires organizations to have a privacy policy, protect all personal information that is collected, allow individuals access to their information and maintain information by keeping it up to date and correct. Individuals can also make complaints to the Office of the Privacy Commissioner.
Furthermore, personal information obtained by a landlord or property management company cannot be disclosed unless the organization has the individual's knowledge or consent unless it is required by law.
What Can Landlords Ask of Prospective Tenants?
Prospective landlords can ask rental applicants for personal information that is required to conduct a credit check. The individual must consent to the provision of this information and must be informed of the purpose for which the information is being used. The latter is of particular importance as there is an ongoing obligation to inform individuals if their personal information is being utilized for a reason that differs from what that individual initially consented to.
Generally speaking, nothing more than an individual's name, address and date of birth is required to conduct a credit check. Though not necessary, a prospective landlord may request a driver's license, passport, employer, income and expenses in order to obtain a more detailed credit check. Individuals are not, however, required to provide their SIN number to any private-sector organization, including a landlord.
Notable Decisions from the Office of the Privacy Commissioner - Is There a Breach?
The following is a sample of some recent cases that provide guidance on various areas where landlords must comply with PIPEDA.
PIPEDA Case Summary #342 - Must Disclose Information where Required by Law
PIPEDA contains exceptions to the requirement that consent must be provided before landlords can share personal information. One such exception is where the information is required by law.
In this case, a complaint was made by the owner of a townhouse who was asked by the property management hired by her condominium corporation to complete a "Summary of Lease or Renewal" form. The form sought information (including the amount of rent paid) that was required under provincial condominium legislation. The complainant refused to fill out this information and filed a complaint. The Commissioner determined that the property management company had not violated PIPEDA because of the exception outlined in Principle 4.5.
PIPEDA Case Summary #349 - Personal Information includes Photographs
This case established that taking photographs of a tenant's apartment qualifies as the collection of personal data under PIPEDA. The landlord of a property management company provided notice to his tenants that staff would be entering units to inspect them for the purpose of an insurance assessment. On the date of the inspection, one of the tenants was home and discovered that the staff members were taking photographs of every room of the apartment. The property management company denied that the photographs constituted personal data because they were taken to establish the state of repairs in the individual units and for no other purpose. It also denied that it required consent from the tenants to take photographs of the units and relied on section 21(2)(2) of the Tenant Protection Act (TPA), which entitles a landlord to enter a rental unit in accordance with written notice given to the tenant at least 24 hours before the time of entry to allow a potential mortgagee or an insurer to view the unit.
The Commissioner found that the property management company was in contravention of Principles 4.2, 4.3, 4.3.2 and 4.8. It was confirmed that taking photographs on an individual's apartment qualified as personal information because various aspects of a person's personal life are exposed by the photographs, regardless of their intended use. As a result, the Commissioner confirmed that tenants must be notified and consent must be obtained before a landlord can take pictures of an individual rental unit. The section of the TPA referenced above does not exempt landlords from their duties under PIPEDA.
PIPEDA Case Summary #2014-006 - Consent is Waived when a Rental Agreement is Violated
A complaint was brought by a tenant after an inspection of the apartment was conducted by a third party inspector, which included taking photographs of the apartment. The privacy commissioner rejected the tenant's complaint that the landlord had violated Principle 4.3, Schedule I of PIPEDA by collecting these photographs without the consent of the tenant. The collection of this information was permitted because the landlord had a reasonable belief that the tenant was in violation of the rental agreement. The landlord and the tenant had a verbal agreement that restricted the number of marijuana plants that the tenant could grow for medical purposes to four. Despite numerous attempts, the tenant refused the landlord entry to the apartment for a legitimate maintenance issue because he was concerned that it would disrupt the production of his plants. This caused the landlord to become suspicious of the scope of the operation and he had an inspection conducted after providing the tenant with notice of same. Upon inspection, the tenant was in possession of over sixty plants.
The privacy commissioner found that while photographs of an individual's apartment do qualify as ‘personal information' under PIPEDA, the landlord did not require the consent of the tenant in this case based on the exemption provided in s.7(1)(b). This section allows an organization to collect an individual's personal information without his/her knowledge or consent when the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of Canadian law.
PIPEDA Case Summary #2009-017 - "Bad Tenants" List is Rejected due to Lack of Knowledge
This case stems from a complaint made by a tenants' rights advocacy group in regards to an organization consisting of landlords across Ontario that was found to have improperly collected and disclosed personal information without the knowledge and/or consent of the individuals that the information pertained to. The organization offered various services to members (i.e. landlords) such as assistance in providing background checks, as well as tracing and tracking tenants. In exchange for these services, members were required to provide the organization with information about their tenants including their social insurance numbers, phone numbers, addresses and credit card information. One service provided by the organization was the creation of a "bad tenant" list and a "delinquent tenant" list, which was populated based on the information provided by member landlords.
There was an additional complaint that the organization was not properly safeguarding the information it obtained. A member of the tenants' rights group discovered that anyone could access the information on the website, which included credit and rental history.
Because the tenants were not informed that their information was being shared with this organization, or the purpose it was being used for, the privacy commissioner found that the operation of this site was in violation of PIPEDA and was not saved by any of the exceptions to consent. The commissioner found that the landlords and the third-party organization had a responsibility to ensure that fully informed consent relating to the type of information being collected and its intended use must be obtained. The commissioner also provided a list of recommendations to ensure that this information remained secure and available only to members of the organization. This case has led to investigations of similar organizations in British Columbia and Alberta.
How to Ensure Compliance with PIPEDA
Individual landlords who have a single tenant simply need to comply with the guidelines set out by PIPEDA when collecting and disclosing the information provided to them by a prospective or current tenant. This can be accomplished by ensuring that a lease or rental agreement contains provisions that address what information is being collected and how it will be used. These terms should be clear and outline potential third-party recipients of the information being collected (this can be relayed by class rather than naming individual organizations).
In the case of a property management company that services many tenants across multiple properties, further steps should be taken. Property management companies should ensure that they develop a privacy policy and designate a staff member to be the privacy officer. The privacy officer should be responsible for ensuring that the company is in compliance with PIPEDA and that procedures are established. This person will also be responsible for receiving and investigating complaints. All employees should receive training on PIPEDA from the privacy officer.
1 S.C. 2000, c. 5, s.
2.
2 Ibid at s.7.
